# UK GDPR gap audit: evidence plan and board summary

Use this working document to organise a proportionate review of actual controls. Complete the evidence and sampling fields before assigning findings. A completed self-assessment is not independent assurance or an ICO certification.

Document edition 2 — 1 November 2026

Organisation / activity: 
Owner: 
Reference and version: 
Review date: 

## 1. Commission and define the review

- Identify the legal entities, teams, locations, services and processing covered. Record exclusions and why they are reasonable.
- Identify affected groups, especially children, patients, vulnerable people and workers. Set the depth of testing by risk.
- Name an accountable sponsor, operational lead and independent reviewer where used. Record conflicts and access restrictions.

Organisation and legal entities: 
Review period and version: 
Sponsor / audit lead / reviewer: 
In-scope processing and locations: 
Exclusions and limitations: 
Sensitive data and priority risks: 

## 2. Build the evidence and sample plan

- Request dated policies, ROPA, lawful-basis decisions, notices, supplier contracts, security evidence, transfer records, DPIAs, rights and complaints logs, breach records and training evidence.
- For each control, record the evidence source, owner, version and relevance. A policy existing does not prove staff follow it.
- Choose sample files, transactions and interviews; record the sampling rationale, size and limitations. Keep sensitive source material in the organisation’s controlled systems.

Control / obligation: 
Evidence reference and document date: 
Evidence owner: 
Sample population and selected sample: 
Interview role and date: 
Test method / expected result / observed result: 

## 3. Record and explain each finding

- Record the requirement, observed condition, evidence, likely cause and potential impact on people.
- Use Red for a material unresolved gap, Amber for a partial or weak control, and Green only for a control supported within the stated review scope. Keep Unknown and Not applicable separate; explain every exclusion.
- Give urgent incidents, overdue rights requests and high-risk processing immediate escalation. A RAG score is not a legal conclusion or permission to continue processing.

Finding ID and relevant processing: 
Requirement / source: 
Observation and evidence reference: 
RAG / Unknown / Not applicable with reason: 
Risk to individuals: 
Immediate escalation or containment required: 

## 4. Assign and verify remediation

- Specify a concrete action that addresses the cause, not simply an instruction to update a policy.
- Assign a named owner, target date, resources, dependencies and verification evidence. Distinguish project targets from legal deadlines.
- Close a finding only after the reviewer has checked completion evidence. Record deferred decisions and who has authority to make them.

Finding ID / corrective action: 
Owner and accountable manager: 
Priority / statutory deadline if any: 
Target date and dependencies: 
Completion evidence and verification date: 
Residual issue / decision / next review: 

## 5. Prepare the board summary

- State the review scope and evidence limitations at the start. Summarise the most serious risks and the decisions leadership must make.
- Separate numbers of assessed controls, unassessed controls and excluded controls. Do not present incomplete answers as a compliance percentage.
- Explain investment, staffing or supplier decisions needed and the consequences of delay.

Executive conclusion within scope: 
Top three risks to individuals: 
Critical overdue or time-sensitive matters: 
Red / Amber / Green / Unknown / N/A counts: 
Decisions and resources requested: 
Progress measures and next board reporting date: 

## 6. Approve and maintain the audit record

- Record reviewer and sponsor decisions separately. Board acknowledgement is not proof that every legal duty is satisfied.
- Set review triggers for new systems, suppliers, legal changes, incidents and material changes to processing.
- Apply access controls and an appropriate retention period to audit evidence and interview notes.

Reviewer / date / comments: 
Sponsor decision and date: 
Unresolved disagreements: 
Follow-up review date and triggers: 
Evidence storage location and access: 
Retention and disposal decision: 

## Sources

- ICO accountability and governance guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/
- ICO accountability audit toolkit: https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/leadership-and-oversight/