GDPR.ME.UK · WORKING DOCUMENT 68
UK GDPR gap audit: evidence plan and board summary
Use this working document to organise a proportionate review of actual controls. Complete the evidence and sampling fields before assigning findings. A completed self-assessment is not independent assurance or an ICO certification.
Document edition 2 · 1 November 2026 · Adapt to your processing and evidence. Use references rather than personal records.
Record details
1. Commission and define the review
- Identify the legal entities, teams, locations, services and processing covered. Record exclusions and why they are reasonable.
- Identify affected groups, especially children, patients, vulnerable people and workers. Set the depth of testing by risk.
- Name an accountable sponsor, operational lead and independent reviewer where used. Record conflicts and access restrictions.
2. Build the evidence and sample plan
- Request dated policies, ROPA, lawful-basis decisions, notices, supplier contracts, security evidence, transfer records, DPIAs, rights and complaints logs, breach records and training evidence.
- For each control, record the evidence source, owner, version and relevance. A policy existing does not prove staff follow it.
- Choose sample files, transactions and interviews; record the sampling rationale, size and limitations. Keep sensitive source material in the organisation’s controlled systems.
3. Record and explain each finding
- Record the requirement, observed condition, evidence, likely cause and potential impact on people.
- Use Red for a material unresolved gap, Amber for a partial or weak control, and Green only for a control supported within the stated review scope. Keep Unknown and Not applicable separate; explain every exclusion.
- Give urgent incidents, overdue rights requests and high-risk processing immediate escalation. A RAG score is not a legal conclusion or permission to continue processing.
4. Assign and verify remediation
- Specify a concrete action that addresses the cause, not simply an instruction to update a policy.
- Assign a named owner, target date, resources, dependencies and verification evidence. Distinguish project targets from legal deadlines.
- Close a finding only after the reviewer has checked completion evidence. Record deferred decisions and who has authority to make them.
5. Prepare the board summary
- State the review scope and evidence limitations at the start. Summarise the most serious risks and the decisions leadership must make.
- Separate numbers of assessed controls, unassessed controls and excluded controls. Do not present incomplete answers as a compliance percentage.
- Explain investment, staffing or supplier decisions needed and the consequences of delay.
6. Approve and maintain the audit record
- Record reviewer and sponsor decisions separately. Board acknowledgement is not proof that every legal duty is satisfied.
- Set review triggers for new systems, suppliers, legal changes, incidents and material changes to processing.
- Apply access controls and an appropriate retention period to audit evidence and interview notes.
Sources and completion
- ICO accountability and governance guidance (opens in a new tab)
- ICO accountability audit toolkit (opens in a new tab)
Record who reviewed and approved the document. Save a working copy to reopen it later, or export the completed HTML record. Your entries stay in this page; automatic storage is not enabled. A downloaded record may contain sensitive operational information.
The template does not verify facts, perform an audit, submit a notification or execute a contract.