The ten connected reviews
UK GDPR reviews. Evidence, gaps and actions.
A structured audit should connect the written policy with the evidence of what happens in practice.
Choose a compliance review area
Start with a self-assessment
The free on-page review records your answers and evidence references. A complete professional audit also needs document review, interviews, data-flow mapping and sample testing.
Start the 50-question reviewCompliance gap audit
Governance, evidence and a prioritised plan
Data protection impact assessments
High-risk processing, mitigations and approval
Records of processing
A working record of what happens to data
Lawful basis & privacy notices
Purpose-by-purpose decisions and clear notices
Retention & deletion
Justified periods, deletion and legal holds
International transfers
Overseas access, safeguards and transfer risk
Breach response
Recognition, escalation and notification decisions
Subject access requests
Searches, deadlines, redaction and exemptions
DPO & ICO fee
Roles, independence and registration checks
Cookies & direct marketing
Tags, consent, exceptions and marketing lists
What a completed review should produce
Evidence-linked gap report
RAG findings with source evidence, scope, uncertainty and the consequence of the gap.
Prioritised remediation plan
A named owner, target date, dependencies and completion evidence for every action.
Board summary
A concise account of key exposures, resources needed and decisions for leadership.
Follow-up record
A review date and a record of whether each action changed the process in practice.