GDPR Compliance Audit Checklist Template

What the GDPR Audit Checklist Covers

1. 1
   Phase 1

   Phase 1: Scope & Data Inventory

   5 tasks

   The first task’s scope answers drive the conditional steps in Phases 3 and 5.

   • Set the audit scope and applicable regimes — record the audit period, the legal entities and systems in scope, and whether EU GDPR, UK GDPR or both apply
   • Carry forward last year’s findings — list every open action from the previous audit and confirm its status with evidence, not a verbal update
   • Refresh the data inventory with system owners — capture every new SaaS tool, AI service and data flow introduced since the last audit
   • Reconcile the inventory to the Article 30 records — every system and purpose appears, with separate records where the organisation also acts as a processor
   • Test any reliance on the Article 30(5) exemption — it covers organisations under 250 staff only where processing is occasional, low-risk and excludes special category or criminal offence data
2. 2
   Phase 2

   Phase 2: Lawful Basis, Consent & Transparency

   5 tasks

   • Confirm a documented lawful basis for every purpose — an Article 6 basis for each line of the records, plus an Article 9 condition for special category data
   • Review legitimate interests assessments — each one current and balanced; for UK processing, note where a recognised legitimate interest under Article 6(1)(ea) now applies
   • Sample consent records — consent is specific and recorded, withdrawal is as easy as giving it, and withdrawals reach every marketing system
   • Compare privacy notices with the records of processing — every purpose, recipient, retention period and transfer in the record is described under Articles 13 and 14
   • Check cookie consent against what the site actually sets — scan the live site and compare it with the banner and the cookie policy
3. 3
   Phase 3

   Phase 3: Data Subject Rights & Complaints

   6 tasks

   The last two tasks appear only when the UK GDPR applies.

   • Pull the rights request log for the audit period — volumes by right, response times, extensions, refusals and fees charged
   • Test response times against the one-month deadline — extensions of up to two further months only for complex or numerous requests, and the requester told within the first month
   • Sample completed access requests — identity checks proportionate, searches complete, third-party data redacted and the reply explains the requester’s rights
   • Trace erasure and objection requests to every system — including processors, CRM exports and marketing suppression lists
   • UK: check use of the stop-the-clock rule — pauses only while clarification was reasonably required to identify the information requested, under Article 12A
   • UK: confirm the data protection complaints procedure — an easy way to complain, such as an online form, acknowledgement within 30 days and a recorded outcome, under DPA 2018 section 164A
4. 4
   Phase 4

   Phase 4: Processors & Article 28 Contracts

   5 tasks

   • Reconcile the processor list to supplier payments — find the tools bought on a company card that never reached the privacy team
   • Check each processor contract covers Article 28(3) — documented instructions, confidentiality, security, sub-processor terms, assistance, deletion or return and audit rights
   • Review sub-processor change notices received in the period — each one assessed, and objections raised where the change adds risk
   • Confirm processors must report breaches to you without undue delay — the contract sets a timescale that leaves you room to meet your own deadline
   • Flag processors due a security reassessment — pass them to the vendor risk process rather than re-running due diligence inside the audit
5. 5
   Phase 5 — If Transfers

   Phase 5: International Transfers

   5 tasks

   Shown only when Phase 1 records that personal data leaves the UK or EEA.

   • List every restricted transfer — destination, importer, data categories and purpose, including sub-processors and support access
   • Record the transfer mechanism for each — adequacy, EU Standard Contractual Clauses, the UK IDTA or Addendum, binding corporate rules or an Article 49 derogation
   • Verify US importers on the Data Privacy Framework List — certification active, and for UK data, signed up to the UK Extension
   • Check transfer risk assessments are on file and current — reviewed when the destination’s law or the importer’s processing changes
   • Document a fallback for each DPF-reliant transfer — which clauses you would switch to if the framework were struck down
6. 6
   Phase 6

   Phase 6: Security, Breach Readiness & DPIAs

   6 tasks

   • Review Article 32 security measures against current risk — access reviews, encryption, MFA, backups and test results, evidenced by IT rather than self-declared
   • Review the breach register — every incident recorded under Article 33(5), including those not notified, with the reasoning for the decision
   • Test the 72-hour notification clock — for each notified breach, time from awareness to notification, with reasons recorded for any delay
   • Run a breach decision tabletop — who decides whether to notify the regulator, and when a high risk means telling individuals under Article 34
   • Check the DPIA register — each high-risk processing started in the period had a DPIA before it began, with mitigations tracked to closure
   • Screen new projects against Article 35(3) and the regulator’s list — profiling with significant effects, large-scale special category data, large-scale public monitoring
7. 7
   Phase 7

   Phase 7: Accountability, Report & Remediation

   6 tasks

   Assigned to the DPO or privacy lead; sign-off sits with a named senior manager.

   • Confirm the DPO position — designated where Article 37(1) requires it, reporting to the highest management level, free of conflicts; or record why none is required
   • Confirm representatives and registrations — an Article 27 representative where required and, for UK controllers, the data protection fee paid unless exempt
   • Check training and policy reviews — completion against target and every data protection policy reviewed within its stated cycle
   • Rate each finding and draft the audit report — high, medium or low, with the article reference, an owner and a due date
   • Present the report and obtain management sign-off — record decisions, accepted risks and who accepted them
   • Schedule the remediation follow-up — re-test high-rated findings within a quarter rather than waiting for next year’s audit