A GDPR audit examines a defined scope, collects evidence, identifies deviations and produces a prioritized roadmap.
In brief
A GDPR audit examines a defined scope, collects evidence, identifies deviations and produces a prioritized roadmap.
It generally takes two to four weeks for an SME, depending on the availability of the teams and the quality of the documents. The price starts around €1,200 excluding tax at RCM.
What to prepare
Objective and scope of the processing or mission.
Actors, tools, suppliers and flows concerned.
Documents, contracts and decisions already available.
Boundaries
This content provides general information. It does not constitute legal advice tailored to any particular situation.
To compare GDPR audit costs, first compare the activities examined, interviews, required evidence and deliverables. An initial assessment, a document review and a multi-entity audit involve different work. A proposal should make those differences clear before you commit.
Choose the audit objective
Explain the trigger: initial organisation, a European contract, an incident or a system change. Define the departments, locations and systems covered. A concrete question produces a more useful report than a request for “total compliance”. Identify staff who can explain practices and provide evidence.
Check what will actually be examined
Ask which documents, interviews and samples are planned. Records, notices, contracts and procedures should be compared with actual operations. A documentary security review is not a penetration test. If technical testing is needed, commission a separate engagement with a suitable specialist.
Ask for an actionable roadmap
A useful finding identifies the observation, evidence, risk and recommended action. The roadmap should support assignment of owners and deadlines. Ask for an anonymised report structure. Check whether drafting missing documents and following up remediation are included or belong to a later phase.
Prepare an unambiguous quote request
List entities, priority activities and existing documents. Flag Moroccan requirements that need parallel assessment. RCM defines scope and limitations before starting; read the commercial page’s published price together with those conditions. No audit guarantees that future incidents or regulatory reviews will never occur.
Practical questions
What should I prepare before contacting RCM?
Prepare: Business objective and scope; Interviews and required documents; Expected report and action plan; Included remediation or separate phase. Include your deadline and unresolved decisions. A summary is enough for the initial conversation.
Does an introductory call replace the engagement?
No. The introductory conversation clarifies your requirements. A proposal then defines documents reviewed, deliverables, responsibilities and price before work starts. Customer or regulator decisions are not guaranteed.
RCM