We define which business areas, systems, and suppliers are in scope and collect the materials you actually use day to day to establish a realistic starting point.
GDPR audit
A GDPR lawyer from Morling Consulting carries out a GDPR audit to prioritise necessary measures
What is a GDPR audit and why does it matter for businesses?
Conducting a GDPR audit means assessing how well your organisation complies with the General Data Protection Regulation (GDPR) — not only on paper, but in day-to-day practice. Starting the work before an incident occurs or the Data Protection Agency makes contact enables you to handle the situation confidently and in line with GDPR requirements. Getting ahead through a structured GDPR audit allows shortcomings to be addressed in time, before risks materialise. A targeted data audit GDPR can be scoped to focus on high-risk areas while still giving reliable assurance.
Some companies rely on a single data protection policy as their main evidence of compliance. This is insufficient in practice. Ongoing documentation, systematic checks and clear procedures are required — especially for processing special category personal data or transfers to third countries. A data protection audit can often be delivered with modest resources, based on document review, process walkthroughs and workshops with key stakeholders. Where relevant, a focused data audit GDPR can be used as a precursor to a full review.
The notion of being “finished with the GDPR project” after initial implementation is misplaced. The regime is built on accountability over time, and after a few years processing often diverges from what was documented when the initial implementation concluded. This means organisations must regularly update their records of processing. Here, an assessment of GDPR compliance is a powerful way to meet these obligations and avoid unnecessary surprises in any future supervisory review.
Approach for a GDPR review
We check how your processing meets key requirements—such as legal basis, information to data subjects, governance of processors and transfers—and factor in risk to the individuals concerned.
You get a clear picture of where there are gaps and uncertainties, and which improvements deliver the greatest impact based on risk, business criticality, and feasibility.
We turn the priorities into concrete activities with ownership and a timeline, and update or produce the necessary documentation, routines, and supporting materials so you can work in a traceable way going forward.
We establish a simple structure for recurring checks and review cycles, so your data protection work stays coherent as processes, systems, and ways of working change over time.
Prepare for review
An effective audit starts with being able to show traceability in contracts, records and routines. Build a clear line from your processes to the documentation that shows how you operate in practice. Click through to close gaps before they become audit questions.
How to run a GDPR audit: a practical GDPR audit checklist for businesses
A tailored GDPR audit checklist is an effective tool to assess the current state and identify risk areas. Examples of what a GDPR audit checklist for businesses should cover include:
- Does the organisation maintain an up-to-date record of processing activities (ROPA) covering all processing?
- Is a lawful basis documented for each processing activity?
- Are consents clearly documented and do they meet the requirement of being freely given?
- Are ongoing assessments performed of the risks posed to data subjects by the processing?
- Have data processing agreements been concluded with all vendors acting as processors?
- Is there an internal procedure for incident management?
- Are regular trainings and audits carried out (for example, a GDPR compliance audit)?
- Is there documentation on how data subject rights are handled?
- Has a GDPR GAP analysis (GDPR gap assessment) been performed?
The checklist structures the compliance work and clarifies where actions or governance are missing. Even smaller organisations often have more personal data flows than first assumed — for example in CRM systems, newsletters, cloud services or subcontractors. A review provides valuable oversight and reduces the risk of overlooked gaps. Where helpful, supplement the checklist with a concise GDPR audit questionnaire tailored to key roles.
Proactive data protection assessment
GDPR Gap Assessment: identify weaknesses before the regulator does
A GDPR gap assessment is a methodical review of the difference between the current state and the requirements the organisation must meet. For many, it can be difficult to judge whether documentation, contracts and procedures are sufficient. The gap assessment provides clarity — highlighting both what works and what needs remediation.
The work starts by compiling and mapping all processing of personal data. Compliance is then assessed against GDPR requirements, article by article. The analysis shows where procedures are missing, where documentation is incomplete, or where uncertainties exist — for example in transfers to third countries or handling of special category data. The result is a concrete action plan to close the gaps.
An important part of a gap assessment is identifying organisational shortcomings. Do employees have the right training? Is accountability clearly allocated? Who does what in a personal data incident? Many issues noted by supervisory authorities are not deliberate violations but the absence of clear processes. Unclear roles and responsibilities can delay incident response, increasing the risk of harm and sanctions. Even simple improvements — such as documenting internal procedures or appointing a data protection lead — can have a major impact. A sound gap assessment looks beyond legal documents to how data protection is embedded in daily operations.
Finding your weaknesses is not a defeat — quite the opposite. A proactive gap assessment demonstrates that the organisation takes responsibility, which carries considerable weight in any future review. It also builds trust internally, externally and with customers who increasingly ask about data protection. A professional compliance analysis under GDPR is often the best way to obtain an objective view of your current position and to prioritise the right actions.
GDPR audit — get a status check on real-world compliance
A GDPR audit shows how well your organisation complies with the GDPR in practice. By systematically reviewing documentation, procedures and actual working methods, issues can be identified and resolved — before they lead to incidents or interventions by the Data Protection Agency. The audit delivers a clear baseline and a concrete action plan that strengthens both compliance and trust. A concise gdpr audit questionnaire can be used alongside interviews to confirm how processes work in reality.
We help you deliver a data protection audit tailored to your operations. Want to know more about how we run GDPR audits? Contact us — we will outline our approach and design a solution for your organisation.
Frequently asked questions on GDPR audit
A GDPR audit maps how well the organisation follows the rules governing personal data processing — not only formally, but in day-to-day operations. It identifies gaps in documentation, procedures and accountability, and results in an action plan to ensure compliance.
An audit is tailored to the organisation’s needs but commonly includes:
- Document review: Records of processing (ROPA), data processing agreements, internal policies.
- Process walkthroughs: Procedures for consent, risk assessments, handling of data subject rights, and onboarding processes for customers or members.
- Interviews and workshops: With key stakeholders to assess understanding and real-world implementation. A targeted gdpr audit questionnaire can streamline this step.
A GDPR audit is a broader concept that includes both review and assessment of compliance. A GDPR gap assessment focuses more specifically on documentation and on mapping the difference between the current state and what GDPR requires — a vital tool in preventative data protection work.
Recurring issues in reviews of GDPR compliance include:
- Lack of up-to-date documentation: For example, the record of processing is missing or outdated.
- Unclear accountability: It is not evident who is responsible for data protection within the organisation.
- Insufficient procedures: For incident reporting, handling of data subject rights and managing special category data.
There is no formal interval requirement, but an annual audit is recommended — especially if the business changes rapidly or processes special category personal data. For major changes, such as new IT systems or entering new markets, a new audit should be considered. Ongoing updates to the GDPR gap assessment are advisable in organisations with extensive processing.
Yes. All organisations must follow the GDPR. While the scope can be adapted, every organisation must ensure personal data is handled lawfully and securely. A gap assessment helps identify risks even in smaller businesses, where data protection resources may be limited.
Begin by gathering current documentation: the ROPA, processor agreements, internal policies and prior analyses. Review procedures for rights handling, incidents and consent. It helps to appoint an internal contact to coordinate the work. A structured GDPR audit checklist and a focused gdpr audit questionnaire accelerate the process.
After the audit, the organisation receives documentation of identified issues and concrete recommendations. This may take the form of a report or a gap assessment, together with a practical action plan. The aim is to prioritise measures that strengthen compliance and reduce the risk of future enforcement by the Data Protection Agency. At Morling Consulting, we also support implementation and follow-up.
If more than a year has passed since your last review of data protection, or if the business has changed — for example new systems, vendors or business models — it is often time for an audit. Even without prior incidents or supervision, a GDPR audit helps confirm that you still meet requirements in practice.
A common mistake is to treat the audit as a one-off exercise. To achieve real compliance, identified actions must be followed up, documented and embedded in business processes. This requires an accountable function with resources and a clear plan.
Internal mapping is possible, particularly in smaller organisations. However, internal reviews may miss issues, especially where documentation and processes have grown organically. An external reviewer provides an independent perspective, often increasing both the quality and credibility of the result — particularly with regulators or customers.
Support is always tailored to your size, sector and risk profile. Examples of activities include:
An audit engagement can include different components depending on your needs. Examples include:
- Preliminary document review focusing on data processing agreements, the ROPA and internal policies.
- Discussions with key stakeholders to assess how data protection works in practice.
- Analysis of procedures for handling data subject rights, consent and incidents.
- Assessment of compliance against core GDPR articles and creation of an action plan.
- Recommendations on internal governance, accountability and further training needs.
The audit results in materials that support both prioritised remediation and strategic decisions on data protection. This may be, for example, a gap assessment. Through a structured assessment, your organisation gets a clear view of the current state and a concrete plan to strengthen GDPR compliance.
Combining interviews with a targeted GDPR audit questionnaire improves coverage and consistency, and helps validate controls across teams and markets. For distributed organisations, standard questions can anchor a common approach and feed your GDPR audit checklist.
Speak to a GDPR lawyer
Do you need a GDPR audit that leads to the right priorities? Contact us to discuss
"*" indicates required fields