RCMWhat is this service?
A GDPR audit, also called a gap analysis, compares what your organisation actually does with personal data against what the GDPR requires. It goes beyond checking that documents exist: it tests team practices, the tools in use and the evidence you can show.
You receive a list of reasoned gaps ranked by risk, and a roadmap that shows what to fix first, who owns each action and how much effort it takes. It is the most reliable starting point before a compliance project, a European client review or a major change.
Document
Control
Reduce
Decide
Who is it for?
The audit suits SMEs and mid-sized companies in Morocco, the MENA region or Europe that handle personal data of European customers, employees or users and want a precise picture of where they stand.
Situations that trigger the engagement
- A European client sends a GDPR questionnaire or announces a supplier audit.
- A funding round, acquisition or tender requires a clear view of compliance.
- A new product, HR tool or service provider changes how data flows.
- Management wants a baseline before budgeting for a DPO or a compliance project.
Issues we see most often
- A record of processing activities that is missing, incomplete or several years old.
- No retention periods: data piles up in the CRM, mailboxes and backups.
- SaaS providers used without an Article 28 processing agreement.
- Access to EU data from Morocco or another third country without a transfer mechanism.
What the engagement includes
We work on a scope agreed together: one entity, up to 12 processing activities and 3 interviews in the base package.
Deliverables
- Processing map: purposes, data categories, data subjects, tools and recipients for each audited activity.
- Gap matrix: each GDPR requirement reviewed, with the finding, the evidence found or missing, and a risk level.
- Prioritised roadmap: actions ranked by urgency and effort, each with a suggested owner.
- Management summary: two pages to decide budget and timing without reading the full report.
- Debrief meeting: one hour to present the results and answer your teams’ questions.
What you provide
A main contact, access to business owners for the interviews, and your existing documents: privacy notice, provider contracts, information notices and any existing record.
Typical process
Scope
Choose the activities and interviewees.
Interview
Three interviews and evidence collection.
Analyse
Test each practice against the GDPR.
Debrief
Present the gaps and the roadmap.
What the audit adds for companies outside the EU
Many companies in Morocco and the MENA region process European data on behalf of clients in France, Belgium or Germany. The GDPR then often applies through the contract, and the client expects concrete evidence: a record of processing, an Article 28 agreement, security measures and controlled access.
The audit therefore also identifies your exact role for each activity (controller or processor), the data flows between Europe and your country, and the documents a European client will ask you for first.
Important limits
An audit assesses a defined scope at a given date. It does not guarantee future compliance: the roadmap still has to be implemented and followed up.
RCM provides compliance and DPO support. RCM is not a law firm. When specialized legal consultation or litigation representation is necessary, it must be entrusted to an authorized professional.
Frequently asked questions
What is the difference between a GDPR audit and a gap analysis?−
In practice both terms describe the same exercise: measuring the gap between your practices and the GDPR. RCM always delivers both parts, the findings and the action plan.
How much does a GDPR audit cost?+
From €1,200 excl. VAT for one entity, up to 12 processing activities and 3 interviews. The price rises with the number of entities, activities or countries. The quote is fixed after a free 30-minute scoping call.
How long does the audit take?+
Plan for 2 to 4 weeks, including about 15 working days of actual work. Timing depends mostly on the availability of interviewees and documents.
What happens after the audit?+
You can implement the roadmap internally, ask RCM to handle the compliance work, or choose a GDPR Compliance Pack that combines the audit and implementation from €3,200 excl. VAT.
Talk about your situation
Present the context, timeline and actors. We will tell you if this service really meets your needs.
Request scoping →