GDPR Audit: Complete Guide, Key Steps and Checklist for Compliance

The GDPR does not require a GDPR audit as such, but in practice it has become standard for organisations that process personal data. The Regulation requires the controller to be able to demonstrate compliance with its data protection obligations (Article 24) and to regularly evaluate the effectiveness of its security measures (Article 32). This guide presents the six fundamental steps of a GDPR audit, with practical checklists and common examples of non-compliance found in the field. For each phase, find out how to structure the analysis, where to focus your attention and which corrective actions to prioritise as soon as a gap is found.

Why carry out a GDPR audit?

Conducting a GDPR audit lets you check whether internal procedures actually meet GDPR compliance requirements. This exercise often reveals gaps between practice and what the regulation expects of an organisation committed to personal data protection.

The audit also aims to anticipate the questions the CNIL may ask during a possible inspection. It helps prevent financial penalties and protect the organisation’s reputation in the event of a leak or incident. This preparatory work also helps build trust with customers and partners through responsible management of sensitive information.

The six key steps of a successful GDPR audit

To conduct an effective GDPR audit, it is essential to follow a structured methodology. Each of the steps set out here addresses a fundamental aspect of the process, from mapping data processing activities to the final compliance check. Each step includes a checklist of actions to carry out and typical examples of frequently observed shortcomings.

1. Preparing and scoping the audit

The preparatory step sets the objectives of the GDPR audit and defines its scope. A meeting with management and stakeholders identifies the units concerned, the IT systems used and the approximate volume of data processed by the organisation.

During this phase, you should designate key contacts such as the DPO (Data Protection Officer), gather the main documents (existing record of processing activities, internal policies) and plan the interviews to be held later. Poor coordination or appointing a DPO who is absent in practice are weaknesses often detected at this stage.

2. Mapping data processing activities

Mapping data processing activities is the foundation of any GDPR compliance process. It involves listing all operations that directly or indirectly involve personal data: collection, use, storage, sharing or destruction.

If you would like expert support in this process, you can call on a GDPR lawyer who can carry out a GDPR audit tailored to the structure of your business.

Checklist:

• Identification of each processing activity carried out (customers, employees, prospects, suppliers, etc.)
• A precise description of the purposes pursued
• An inventory of the categories of data collected
• The list of internal and external recipients
• The defined retention periods

A common gap is forgetting processors in the mapping, or a retention period that is too vague, often noted as “until termination”, without any supporting justification.

3. Analysing risks to individuals’ rights and freedoms

Risk analysis measures the potential impact of processing on the individuals concerned. It checks the level of security applied and identifies threats to fundamental rights.

Start-ups in particular can refer to a specific guide on GDPR compliance for young companies, to understand all the steps to follow during an audit and put an appropriate action plan in place.

Points to watch:

• Is there an impact assessment covering the most sensitive processing?
• Do specific measures protect so-called “sensitive” data (health, political opinions, etc.)?
• Are paper records subject to the same vigilance as digital files?

Recurring weaknesses include no risk assessment for new projects, or an ageing analysis that was not updated as soon as a main process changed.

4. Checking legal bases and information provided to individuals

Each processing activity must rest on a sound legal basis. The most common remain consent, performance of a contract or compliance with a legal obligation. At the same time, each individual must receive clear information about their rights, in accordance with Article 13 GDPR.

During the audit, check:

• Do the notices provided cover all the information required by the GDPR?
• Is consent collection traceable, and can consent be freely withdrawn?
• Are there communication channels that make it easy to exercise rights (access, rectification, erasure, objection, etc.)?

Cookies are often placed before consent is given, or the information provided is very generic, or even missing from some paper forms.

5. Analysing processing operations and security

This central step involves inspecting each process in detail to identify the weak links in the personal data processing chain. It covers IT systems as well as HR or sales practices.

Checklist of points to examine:

• Management of access to databases and traceability of logins
• Procedures in place to handle an erasure or portability request
• Regular backups and safe routing of backups
• Password policy and appropriate encryption

Common errors include sharing passwords between colleagues, sending unprotected files or having no procedure at all in the event of a breach.

6. Documentation, records and remediation plan

The final step involves gathering all the evidence of GDPR compliance. The record, impact assessments, consent templates and data processing agreements must be accessible and up to date.

Essential items to archive:

• Complete record compliant with Article 30 GDPR
• Documented evidence of information provided to individuals and of how requests are handled
• Contracts including GDPR clauses with every external service provider

A missing record or incomplete contracts are among the most frequent failings revealed by an in-depth audit. A prioritised action plan must then be drawn up to correct these points quickly.

Practical examples of non-compliance found during a GDPR audit

In practice, certain failings come up frequently when checking gaps/compliance:

• Data collected not limited to the declared purpose, for example collecting the date of birth when it is not a relevant criterion for the service offered.
• No automatic deletion policy once the retention period has expired.
• Web or paper form lacking the minimum mandatory information notices.
• Inadequate procedure to ensure the confidentiality of sensitive files shared internally.
• Users unable to request rectification or erasure of their data within a reasonable time.

Each point of non-compliance must lead to a recommended action, with a named person responsible and a precise timetable to avoid any stagnation. This commitment often makes the difference in the event of an inspection by the regulator.

GDPR audit checklist: summary of the steps

Here is a summary table of the main phases to follow:

Step	Objectives	Common risks/non-compliance
Preparation & scoping	Set objectives, designate DPO, prepare documents	Unclear scope, no DPO/designated contacts
Mapping of processing activities	List and characterise all processing activities	Forgotten processing activities, vague retention periods, processors overlooked
Risk analysis	Measure impact, assess security and vulnerabilities	Outdated or unfinished analyses, poorly suited measures
Legal bases & information	Check legal basis, quality of information	Implied consent, omissions in information notices
Process & security analysis	Test the robustness of existing safeguards	Shared passwords, backup weaknesses, uncontrolled access
Documentation & remediation	Assemble evidence and improvement plans	Missing/incomplete records, non-compliant contracts

FAQ: GDPR audit and compliance