What this review helps you do
A UK GDPR compliance gap audit compares each relevant control with current evidence of how the organisation works. Its useful output is a prioritised action register: what was checked, what remains uncertain, who will resolve each gap and how completion will be verified.
AT A GLANCE
Build a defensible picture of your data-protection controls. Compare the policies you hold with the work people actually do, then turn the gaps into an owned, prioritised plan.
Who should use this review?
Any organisation handling personal information; deeper evidence testing is particularly valuable for clinics, employers, legal practices and other sensitive-data environments.
What to review
- Assign accountable leadership, operational owners and independent DPO oversight where required.
- Trace key data flows through systems, suppliers and disclosures. Compare ROPA, lawful-basis decisions, notices, retention rules and actual practice.
- Inspect processor agreements, security controls, transfer safeguards, rights handling, DPIA decisions, breach records and role-based training.
- Interview staff, review dated evidence and test a documented sample of real processes. Include the now-applicable data-protection complaints procedure.
Working outputs
- Evidence-linked RAG gap register with assessment scope and limitations.
- Remediation plan stating action, responsible owner, target date, dependencies and completion evidence.
- Board summary covering major exposures, decisions needed and progress measures.
PUT THIS GUIDE TO WORK
Review it. Record it. Keep the evidence.
Open the relevant assessment area or complete the matching working document.
Evidence checklist
Use these checks to gather references and identify the evidence that still needs testing.
Is a named senior owner accountable for data protection, with current policies and reporting?
Evidence to look for: Approved policy, ownership chart and recent management minutes.
If it is missing: Nominate the accountable owner and approve a proportionate governance plan.
Do records and notices match the systems, suppliers and data flows actually used?
Evidence to look for: Current systems inventory, ROPA and sampled staff interviews.
If it is missing: Map the live processing activities and reconcile conflicting documents.
Are supplier contracts and security controls verified in practice?
Evidence to look for: Executed Article 28 terms, access reviews and documented security checks.
If it is missing: Prioritise missing processor terms and high-risk security gaps.
Can staff demonstrate the procedures for rights requests, incidents and complaints?
Evidence to look for: Training records, case logs and a sample walkthrough.
If it is missing: Test escalation routes and record corrective actions.
Apply the limits carefully
An automated questionnaire is a self-assessment. It cannot independently verify compliance, interview staff or inspect the underlying evidence.
RAG ratings are a prioritisation method, not an ICO certification. Keep urgent legal deadlines separate from suggested project dates.
The ICO’s full Data Protection Audit Framework is designed for large organisations. Small organisations should begin with the ICO’s small-business resources and select proportionate checks for their actual activities and risks. This publication’s independent questionnaire is not an official ICO audit.
Common misunderstandings
The ICO’s accountability tools provide a benchmark for organising evidence. Using that benchmark or completing this assessment does not mean the ICO has approved the organisation or certified its compliance.
Worked example: checking a leaver-access control
Illustrative scenario. This is a fictional teaching example, not a client case, professional finding or verified outcome.
A service business has an approved access policy but wants to know whether the leaver process works. This is a fictional working example, not a client case or an audit result.
- Control
Access should be removed when a person's authorised role ends, using a defined notification and approval process.
- Evidence
Compare the leaver record, service-desk ticket and current account list for a documented sample. Record the systems and dates checked.
- Finding
One sampled account remains active after the recorded leaving date. A signed policy does not resolve the operating gap.
- Owner and action
The IT owner removes inappropriate access, checks for relevant use and follows the incident process if the evidence indicates a potential breach. HR and IT agree how leaver notices will be reconciled.
- Verification
Retain the account-status evidence and rerun the reconciliation after the process change. Record the sample's limits rather than extending its result to every account.
Practical questions
How large should an audit sample be?
Choose and record a sample suited to the risk, activity and available records. Explain which systems, teams and time periods it covers, and widen it if exceptions suggest a broader problem. There is no universal sample number in this guide.
Can a green self-assessment prove compliance?
It records the organisation's answers and evidence references. Independent document checks, staff explanations and operating tests may still be needed. Resolve unknowns explicitly and keep the scope and limitations with the report.
Official sources
- ICO — Guide to accountability and governance (opens in a new tab)
- ICO — Leadership and oversight (opens in a new tab)
- ICO — Policies and procedures (opens in a new tab)
- ICO — Training and awareness (opens in a new tab)
- ICO — Controller-processor contract terms (opens in a new tab)
Source-linked editorial review: 1 November 2026. Guidance supports a documented process. It does not replace advice about your particular circumstances or verify your organisation’s compliance.
Content update — 2 November 2026: added an illustrative evidence record, practical questions and related guidance. The existing legal-source baseline is 1 November 2026.