GDPR Compliance Audit Checklist Template

Phase 1: Scope & Data Inventory

The first task’s scope answers drive the conditional steps in Phases 3 and 5.

• Set the audit scope and applicable regimes — record the audit period, the legal entities and systems in scope, and whether EU GDPR, UK GDPR or both apply
• Carry forward last year’s findings — list every open action from the previous audit and confirm its status with evidence, not a verbal update
• Refresh the data inventory with system owners — capture every new SaaS tool, AI service and data flow introduced since the last audit
• Reconcile the inventory to the Article 30 records — every system and purpose appears, with separate records where the organisation also acts as a processor
• Test any reliance on the Article 30(5) exemption — it covers organisations under 250 staff only where processing is occasional, low-risk and excludes special category or criminal offence data

Phase 2: Lawful Basis, Consent & Transparency

• Confirm a documented lawful basis for every purpose — an Article 6 basis for each line of the records, plus an Article 9 condition for special category data
• Review legitimate interests assessments — each one current and balanced; for UK processing, note where a recognised legitimate interest under Article 6(1)(ea) now applies
• Sample consent records — consent is specific and recorded, withdrawal is as easy as giving it, and withdrawals reach every marketing system
• Compare privacy notices with the records of processing — every purpose, recipient, retention period and transfer in the record is described under Articles 13 and 14
• Check cookie consent against what the site actually sets — scan the live site and compare it with the banner and the cookie policy

Phase 3: Data Subject Rights & Complaints

The last two tasks appear only when the UK GDPR applies.

• Pull the rights request log for the audit period — volumes by right, response times, extensions, refusals and fees charged
• Test response times against the one-month deadline — extensions of up to two further months only for complex or numerous requests, and the requester told within the first month
• Sample completed access requests — identity checks proportionate, searches complete, third-party data redacted and the reply explains the requester’s rights
• Trace erasure and objection requests to every system — including processors, CRM exports and marketing suppression lists
• UK: check use of the stop-the-clock rule — pauses only while clarification was reasonably required to identify the information requested, under Article 12A
• UK: confirm the data protection complaints procedure — an easy way to complain, such as an online form, acknowledgement within 30 days and a recorded outcome, under DPA 2018 section 164A

Phase 4: Processors & Article 28 Contracts

• Reconcile the processor list to supplier payments — find the tools bought on a company card that never reached the privacy team
• Check each processor contract covers Article 28(3) — documented instructions, confidentiality, security, sub-processor terms, assistance, deletion or return and audit rights
• Review sub-processor change notices received in the period — each one assessed, and objections raised where the change adds risk
• Confirm processors must report breaches to you without undue delay — the contract sets a timescale that leaves you room to meet your own deadline
• Flag processors due a security reassessment — pass them to the vendor risk process rather than re-running due diligence inside the audit

Phase 5: International Transfers

Shown only when Phase 1 records that personal data leaves the UK or EEA.

• List every restricted transfer — destination, importer, data categories and purpose, including sub-processors and support access
• Record the transfer mechanism for each — adequacy, EU Standard Contractual Clauses, the UK IDTA or Addendum, binding corporate rules or an Article 49 derogation
• Verify US importers on the Data Privacy Framework List — certification active, and for UK data, signed up to the UK Extension
• Check transfer risk assessments are on file and current — reviewed when the destination’s law or the importer’s processing changes
• Document a fallback for each DPF-reliant transfer — which clauses you would switch to if the framework were struck down

Phase 6: Security, Breach Readiness & DPIAs

• Review Article 32 security measures against current risk — access reviews, encryption, MFA, backups and test results, evidenced by IT rather than self-declared
• Review the breach register — every incident recorded under Article 33(5), including those not notified, with the reasoning for the decision
• Test the 72-hour notification clock — for each notified breach, time from awareness to notification, with reasons recorded for any delay
• Run a breach decision tabletop — who decides whether to notify the regulator, and when a high risk means telling individuals under Article 34
• Check the DPIA register — each high-risk processing started in the period had a DPIA before it began, with mitigations tracked to closure
• Screen new projects against Article 35(3) and the regulator’s list — profiling with significant effects, large-scale special category data, large-scale public monitoring