Conducting a GDPR Compliance Audit

Our GDPR compliance audit checklist will help you establish effective GDPR procedures and controls or serve as a benchmark for your existing processes.

We know it's a long list - but it needs to be! Don't worry if you need to refer to it later; you can just download our PDF questionnaire.

GDPR procedures & controls to audit

1. Governance
2. Responsibilities
3. Lawful processing
4. Data security
5. Data minimisation
6. Data subject rights
7. Data breaches
8. Contracts & suppliers
9. Human resources
10. Overseas transfers

A. Governance

The following questions relate to how well-prepared your governance and systems and controls are regarding GDPR. This questionnaire may go into more detail on some of these topics as you go through it.

1. Do you understand what personal and special categories of personal data mean to your firm?
2. Do you have board support or endorsement for all matters pertaining to data protection and compliance with the GDPR?
3. Do you have a new or revised data protection policy?
4. Has a Data Protection Officer been appointed with sufficient knowledge and experience and with autonomy to implement GDPR as required within your firm and with direct access to the board (or equivalent)?
5. Has a Data Protection Impact Assessment been completed and is a plan to address any deficiencies drawn up?
6. Is your firm registered with the local data protection supervisory authority, and does your declared data use noted with them need to be updated or amended?
7. Have you reviewed your usage and contracts with third-party suppliers and vendors to whom customer data may be passed or who may have access to your systems that contain customer data?
8. Do you have an appropriate data breach reporting procedure? Do your staff know how to report a breach and whom to report it to?
9. Do you have a data breach response protocol in place? Establishing a pre-planned approach to the initial and ongoing management of a data breach
10. Are data breaches reportable via your Whistleblowing process?

B. Responsibilities

The following questions relate to your overall understanding of GDPR obligations.

1. Are you aware of all your obligations under GDPR?
2. Do you believe that any employees reporting to you are aware of their obligations under GDPR?
3. Do you believe that your peers in other key decision-making positions are aware of their obligations under GDPR?
4. Do you understand what personal and special categories of personal data mean to your firm?
5. Can you demonstrate that you have clear and explicit consent from your customers to hold and process the data you hold now?
6. Have you sent new fair processing notices to your customers, advising them of their new rights under GDPR, such as objecting or restricting processing, the right to be erased and the portability of their data?
7. Have you established clear links with your marketing/product development areas to ensure privacy by design?
8. Are you reviewing your website privacy terms and consents?
9. Have you mapped a customer journey to identify all data touchpoints, enabling you to exercise a customer's right to be forgotten with ease and confidence?
10. Have you a mechanism in place enabling breach identification and reporting within 72 hours of occurrence?

C. Lawful processing

The following questions relate to the lawful basis of processing personal data by your team.

1. Do you understand where your customer data is?
2. Do you know where your customer data comes from?
3. Where does customer data go around your company, and how does it travel?
4. Do you know of all types of personal data being processed by your team and the purpose(s) of processing?
5. Have you considered if this processing is necessary for the relevant purpose?
6. Do you know of the lawful basis on which this data is collected and processed?
7. Do you know whether the purpose(s) of processing and the lawful basis are documented in your privacy notice?
8. In case the lawful basis for processing is Consent, are you sure that a record is being kept of when and how we obtained consent from the individual and what they were told about how and why we would process their data at the time?
9. Is customer consent obtained via a clear and standalone statement or document rather than being part of a wider and unrelated set of terms and conditions or declarations?
10. Have you got a process for notifying a customer that we need to change or add to the reasons that we currently process their data, explaining why and obtaining their consent for this change?
11. Do you know when and whom to ask for a data protection impact assessment (DPIA)?
12. How do you manage data classification and communications? How is special category data treated compared to personal data? Are there any additional controls or access restrictions that you apply?
13. Have you issued fair processing notices to your customers?
14. Do you identify child account business separately from all other accounts?
15. How are you demonstrating that where appropriate (aged 13 in the UK), you have child consent for processing their data and that this consent is suitably informed?

D. Data security

The following questions relate to the security (confidentiality, integrity and availability) of the personal data processed by your team

1. Would you be able to evidence that your team has taken measures to protect this personal data from external threats?
2. Would you be able to evidence that your team has taken measures to protect this personal data from internal threats?
3. Do you clearly communicate to your staff that data theft or misuse of customer data in any way is strictly prohibited, and the consequences of such activity could be instant dismissal and even criminal prosecution?
4. Do you have clear internal policies and training in relation to areas of computer misuse, electronic communications, safeguarding personal data on social media and information security?
5. Do you have a record of who (departmental or individual) has access to customer data in your department and their need for this?
6. How do you manage internal staff movement, cloned computer access and access revision and control? How is temp or contract workers' computer access controlled?
7. Does your internal training clearly demonstrate the serious impact of unauthorised data access or loss, by linking data theft, identity fraud, account take over and money laundering?
8. Do you have a clear and easy-to-use breach reporting mechanism?
9. Can one of your team report any concerns relating to data security, confidentially via your Whistle Blowing procedures?
10. Do you have adequate firewalls and virus protection installed?
11. Do you have clear password policies within your firm, i.e. required length, complexity and expiration times?
12. Are controls such as a clear desk policy and locked confidential waste bins employed?
13. Where are your servers located?
14. What encryption protocols are used?
15. Do you have a policy regarding the use of portable media devices and laptops and the procedures to be followed in the event of their loss?
16. Do you have established protocols for home working, including the transportation of data to home sites?
17. Is your data retention and destruction policy clear and in line with the requirements of GDPR whilst being balanced against other potentially conflicting legislative requirements relating to data retention, such as the Money Laundering Regulations?

E. Data minimisation

The following questions relate to data minimisation and storage of the personal data that is processed by your team

1. Is the collection of your customer's personal data limited to what is necessary for the purpose of processing data?
2. Is there a review or sign-off of your application form/data collection mediums designed specifically to confirm only essential data is collected, processed and stored?
3. Do you know if a retention policy is being applied, i.e. this personal data is being erased once the purpose of processing is complete?
4. Do you have a procedure in place, or could you satisfy a request from a customer to restrict the processing of previously obtained data that is no longer considered necessary for the purpose of processing data?
5. How are you prepared to balance the requirement only to collect/process data that is limited to the purpose of processing against other conflicting pieces of legislation?
6. Are you and your staff equipped to identify information that is obtained yet not necessary for the purpose of processing and delete or cease the recording of this information, for example, data revealed during a recorded telephone conversation with a customer or notes made during a customer review, but upon reflection are not required?
7. Where excessive data is noted as being present yet is embedded within other relevant text or information, do you have methods of removing or redacting the unnecessary data? (Lord Sugar cheque as a bad example of redaction)
8. Do you align your data collection and processing procedures against the lawful reasons for processing, i.e. to serve a legal or contractual obligation or being in the vital interests of the individual?

F. Data subject rights

The following questions relate to the rights of individuals whose personal data is processed by your team

1. Do you know if individuals are informed of the purpose and lawful basis under which the processing of their data occurs?
2. How does this notification occur? (whether via our privacy notice or otherwise)?
3. Is the notification in plain English so understandable to the non-expert?
4. Are your notifications (and other relevant information) available in a translated format for non-English speaking customers and/or in other necessary formats such as Braille?
5. Does your team have systems, procedures and training to comply with individuals' Right of Access?
   1. Have you removed any reference to a fee being charged for a data subject access request?
   2. To refuse to respond to a request would require you to prove to the requesting party that their access request was manifestly unfounded; who will be responsible for making such a decision?
   3. Where information that should be released under an access request is embedded amongst other customer's information, do you have the means to either extract the relevant information or appropriately redact the non-relevant information? (Lord Sugar's cheque being an example of poor redaction)
6. Does your team have systems, procedures and training to comply with individuals' Right to Rectification?
   1. GDPR requires that inaccurate data is rectified without undue delay. Can your systems respond with efficiency to demonstrate this?
   2. Are your staff trained to identify and balance the needs and requirements relating to rectification to other matters relating to retention, evidential purposes for example? i.e. knowing when to rectify and to not, or to seek guidance
7. Does your team have systems, procedures and training to comply with individuals' Right to Erasure?
   1. Can you efficiently identify all electronic and paper-based records relating to a customer, no matter where and how they may be stored or located?
   2. Are your systems able to erase customer data totally?
   3. Are your staff trained to identify and balance the needs and requirements relating to erasure to other matters relating to required data retention, evidential purposes for example? i.e. knowing when to erase and when not to or to seek guidance
   4. How could you provide evidence to the data subject, if required, that their data has been deleted?
8. Does your team have systems, procedures and training to comply with individuals' Right to Restrict Processing?
   1. Do your systems allow for the ringfencing of certain data or data sets, preventing that data from use?
   2. Are your staff trained and able to recognise the difference between a rectification, erasure, objection and restricted processing request?
   3. Do you have a checklist for staff use to review a restricted processing request against, which details the four reasons under which a subject can request a restriction of processing to ensure that processing isn't incorrectly or inappropriately restricted?
9. Does your team have systems, procedures and training to comply with individuals' Right to Object?
   1. Do your systems allow for one customer's data to be isolated, extracted or removed from active processing upon their request?
   2. Does an objection from processing cross over all departments in your firm, not just operational, but marketing, call centres and counter staff, for example?
10. Does your team have systems, procedures and training to comply with individuals' Rights related to automated decision-making, including profiling?
    1. Do you have a manual system and experienced resources available to replace an automated decision-making tool?
    2. Do you have the resource capability to handle multiple requests of this nature?
    3. Is consideration given to how you would evidence to a data subject that a manual review and assessment was made when such reaches the same conclusion and decision?

G. Data breaches

The following questions relate to personal data breaches

1. Does your team have systems, procedures and training to recognise personal data breaches?
2. Does your team know when and to whom to report personal data breaches within our Company?
3. Does your company have a data breach response protocol, with consideration given to the following?
   1. Recording the date, time and location of the breach and the date, time and location of when the breach was identified
   2. Recording the date and time that the appropriate breach notification procedure was invoked, including when a response protocol was initiated, such as response efforts
   3. When to alert relevant personnel (including any external) to begin executing breach response protocols
   4. Initiate relevant internal and external (data subjects, media, etc) communications, where necessary, being advised by your legal and press departments. Remember, what is or isn't said can have an impact on your reputation
   5. Secure any affected IT systems to preserve evidence and await any forensic analysis teams required
   6. How to minimise data loss/breaches and prevent further loss/breaches
   7. Interview those involved in discovering the breach
   8. Report to the police if necessary
   9. Report to the data protection supervisory authority (within 72 hours of breach occurrence)
   10. Notifying senior management/board
   11. Keep every step documented
   12. At completion, debrief the response protocol to ensure it was efficient, sufficient and fit for purpose.
   13. Testing of the breach response protocols with a "mock" breach incident

H. Contracts & suppliers

The following questions relate to the use of contractors or vendor suppliers

1. Does your company use any contractors or vendor suppliers?
2. Is any customer data transferred to or accessible by these contractors or vendor suppliers?
3. As part of your procurement process, does your company examine the supplier's data protection policy?
4. Who in your company reviews such a policy? Are they experienced and sufficiently qualified to do so?
5. Is there a data breach indemnity between your two firms? In whose favour does the indemnity run?
6. Does your company have agreed on protocols with the contractor or vendor supplier detailing your expectations relating to data minimisation?
7. Does your company have agreed on protocols with the contractor or vendor supplier, detailing your expectations relating to how they would execute a data processing restriction?
8. Does your company have agreed on protocols with the contractor or vendor supplier detailing your expectations relating to how they would execute a data objection notice?
9. Does your company have agreed on protocols with the contractor or vendor supplier, detailing your expectations relating to how they would execute a right to be forgotten?
10. Is your contractor or vendor supplier located overseas? What is the adequacy of the data protection regime in that country?
11. Is your company the data processor? If so, are you clear on the requirements of your appointing data controller?
12. Do your contracts with the contractors or vendor suppliers (or your appointing data controller) require updating?
13. Does your company run any formal quality assurance programmes against the published data protection policy of the contractor or vendor supplier?
14. Does your company run informal quality assurance testing of the contractor or vendor supplier data protection procedures, such as mystery shopping?
15. Has your company agreed on a data retention and data destruction policy with the contractor or vendor supplier?
16. Does the contractor or vendor supplier's IT system allow for data portability?
17. Is there a formal contract/processing review in place?

I. Human resources

The following questions relate to your HR department

1. Is your HR department aware that each employee is a data subject and that GDPR applies to the collection, processing, storage and deletion of employee data as well as customer data?
2. Has your HR department mapped staff data in the same manner as this questionnaire requires for customer data? I.e. a data subject's rights, use of third-party contractors, minimisation of data, rights to object or restrict, etc.?
3. Are employees provided with a fair processing notice?
4. Are employees able to object to their data being sent overseas to a parent or associated company with the group?
5. Will your company need to use binding corporate rules for employee data processing?
6. Will contracts of employment require amendment?
7. Will your HR department need to obtain revised processing consent for all present and past employees – remember, they are considered to be processing data even if they are only storing it
8. Does or will your HR department view, use or consider the content on employees' or future employees' social media sites for purposes such as checking the legitimacy of sick days or assessing character suitability for a role?
9. Do your staff employment contracts allow for social media data to be used for commercial purposes?
10. Do your job application forms or associated essential literature require consent from a potential employee to review their social media sites and to use any information contained therein as part of the recruitment process?

J. Overseas transfers

The following questions relate to the transfer of customer data or processing of it overseas.

1. Does your company transfer any customer data overseas?
2. If yes, is the country of receipt within the EU?
3. Does your company use any contractor or vendor suppliers?
4. Does that company transfer customer any data overseas?
5. If yes, is the country of receipt within the EU?
6. Are binding corporate rules utilised?
7. By what method is the customer data transferred overseas?
8. Are appropriate robust encryption controls utilised?
9. Is customer consent always sought and received before any overseas transfer of data exists, i.e. through a fair processing notice and consent declaration?
10. What systems and controls exist around transfers of data overseas, and which suitably experienced and qualified person reviews and authorises these controls?

Want to learn more about GDPR?

We've created a comprehensive GDPR roadmap to help you navigate the compliance landscape, supported by a comprehensive library of GDPR Courses.

We also have 100+ free compliance training aids, including assessments, best practice guides, checklists, desk aids, eBooks, games, posters, training presentations and even e-learning modules!

Finally, the SkillcastConnect community provides a unique opportunity to network with other compliance professionals in a vendor-free environment, get priority access to our free online learning portal and other exclusive benefits.