GDPR Compliance Audits: A Practical Guide for UK Organisations

A GDPR compliance audit, often called a GDPR audit or data protection audit, is a structured, evidence-based review of how your organisation handles personal data against UK GDPR and the Data Protection Act 2018. It checks that your records of processing, lawful bases, privacy notices, retention, handling of individual rights, security and supplier contracts work in practice, not just on paper. UK GDPR doesn’t require an audit by name, but the accountability principle in Article 5(2) requires you to demonstrate compliance, and an audit is the most reliable way to produce that evidence.

This guide explains what a GDPR compliance audit covers, how to run one step by step, when an independent review helps, and how to reuse work you already do for ISO 27001 or PCI DSS.

Key takeaways

• Accountability means you must be able to show compliance, not just claim it.
• Start with data mapping: you cannot audit processing you haven’t found.
• Test controls in practice, not just the policies that describe them.
• An independent review avoids the blind spots of marking your own work.
• ISO 27001 and PCI DSS evidence covers much of Article 32, but not the privacy-specific parts of GDPR.

What is a GDPR compliance audit?

It is a review, against UK GDPR and the Data Protection Act 2018, of lawful bases, transparency, data minimisation, retention, individual rights, security of processing, international transfers and processor contracts. It isn’t a legal opinion or a penetration test, though it may draw on both. It also differs from two related exercises:

The ICO’s Accountability Framework sets out what the regulator expects organisations to have in place. It is a useful structure for your audit, and aligning to it makes findings easier to explain if you ever need to.

Is a GDPR audit a legal requirement in the UK?

Not by name. But Article 5(2) makes controllers responsible for, and able to demonstrate, compliance with the data protection principles, and Article 32 requires “a process for regularly testing, assessing and evaluating the effectiveness” of your security measures. In practice, a periodic audit is how most organisations meet both. Customers, insurers and investors increasingly ask to see the result.

The regulator can also audit you. The ICO runs consensual audits by agreement, and can require an assessment by issuing an assessment notice under section 146 of the Data Protection Act 2018. Either way, it looks for the same accountability evidence your own audit should produce.

When should you carry out a GDPR audit?

Most organisations benefit from a formal review every 12 to 24 months. These events justify one outside the normal cycle:

• a DPIA that leaves high residual risk;
• a new system, supplier or business line that changes how personal data flows;
• transfers to a new country, such as a US cloud region or a group company in the UAE;
• a personal data breach, near miss or complaint that reveals a weakness;
• a change in the law. The Data (Use and Access) Act 2025 amends parts of UK GDPR, with provisions commencing in stages, so policies written before it may need review.

Data protection audit: what it covers

A data protection audit, whether you call it a GDPR compliance audit or a UK GDPR audit, covers every area where the law sets a duty, and checks each against evidence rather than policy alone:

Organisations with fewer than 250 employees have a limited exemption from Article 30 records. It doesn’t apply if processing is more than occasional, is likely to result in a risk to individuals, or includes special category or criminal offence data, so in practice most organisations need records.

How do you run a GDPR compliance audit?

1. Discovery and scope. Agree which entities, systems, processing activities and jurisdictions are in scope, who owns each, and the criteria: UK GDPR, the ICO Accountability Framework and any contractual commitments to clients.
2. Map the data. Follow each processing activity from collection through storage, use, sharing and destruction. Shadow IT is the usual gap: spreadsheets on shared drives, unsanctioned SaaS tools, old exports in mailboxes. Interviews find some of it; scanning file shares and cloud storage for personal data finds the rest.
3. Review the documents. Privacy notices, ROPA, DPIAs, legitimate interests assessments, consent records, retention schedules, processor contracts and the breach log. Check they agree with each other as well as with the law.
4. Test the technical controls. Access and leaver processes, encryption, logging, backups, patching and secure deletion. Where it adds value, vulnerability scanning services or targeted penetration testing services provide independent technical evidence.
5. Interview the people who handle data. Ask HR, marketing, customer service and IT to show you how they answer a subject access request or delete a customer record. Informal workarounds surface quickly. Check that staff recognise a breach and escalate it fast enough to meet the 72-hour deadline.
6. Record and rate the gaps. Record each finding against the requirement it breaches, with evidence, and rate it by risk to individuals and to the organisation, not by how easy it is to fix.
7. Report and plan. Give the board a short summary of the position, the main risks and a remediation plan with owners and dates. Put the detail in an appendix for the DPO and system owners.

GDPR compliance checklist

Use this GDPR compliance checklist before an audit, or as a quick self-check between audits. Tick a line only when the evidence exists. To print it or share it with system owners, download the GDPR compliance checklist (.xlsx), free and with no sign-up: it adds columns for status, owner and evidence location, and a second sheet for rating each audit area and recording findings.

A checklist shows whether the pieces exist; the audit then tests whether they work in practice.

Should the audit be internal or independent?

Internal reviews are valuable and inexpensive, but the people who built a process are poorly placed to see where it has drifted, and checklists tend to confirm that a policy exists rather than test whether it works. An independent auditor brings distance (no stake in the current design), comparison (they have seen how other organisations fail) and credibility (a documented independent review is stronger evidence for the ICO, a client or an insurer).

A sensible model for many organisations is an internal self-assessment each year, with an independent audit every second year or after significant change.

How does GDPR overlap with ISO 27001, ISO 27701 and PCI DSS?

For what a certificate does and does not prove under Article 32, see our guide to Cyber Essentials and GDPR.

The practical benefit is less duplication: test a control once, record which frameworks it supports and keep a single evidence library. If you are working towards certification, an ISO 27001 gap analysis can map gaps against UK GDPR security and accountability requirements at the same time. Card data is personal data too; our guide to PCI compliance in the UK explains what PCI DSS requires, and our comparison of GDPR and PCI compliance shows where the two overlap. For the wider business case, see our article on the benefits of ISO 27001.

What happens after the audit?

Deal with high-risk findings first. These are typically missing lawful bases, undocumented transfers, excessive retention and weak access control. Track remediation to completion, re-test the controls you changed, and feed the results into the next audit cycle.

People are often the weakest link: an email to the wrong recipient, a phishing link clicked, a spreadsheet shared publicly. Our guide to cyber security awareness training explains how to build a programme that changes behaviour.

Why Sovereign Secure?

Sovereign Secure is ICO registered, ISO 27001 certified and a PCI SSC Qualified Security Assessor (QSA) company. We focus on the security and accountability side of data protection: ISO 27001 implementation, security testing and PCI DSS assessment, with evidence mapped so it can support your GDPR audit.

Next step

If you want your GDPR evidence to sit inside a certified management system, our ISO 27001 consultancy covers implementation and certification through our partner certification body, MQA International. To discuss the security testing or gap analysis that supports a GDPR audit, contact our team.