What the assessment does
The questionnaire turns your own answers into a structured review. It records the status of 50 controls across ten areas and produces a gap report, an action list and a board summary. It does not inspect files, interview staff, run a technical security test or check a supplier’s current contract.
How to answer
| Response | Meaning |
|---|---|
| Evidenced | The control is implemented and you can identify current evidence. Add an evidence reference. |
| In progress | The control exists in part, or implementation/testing remains incomplete. |
| Gap | The control is required but missing or materially ineffective. |
| Unknown | You cannot yet establish the position. Resolve the uncertainty. |
| Not applicable | Record a reasoned scope decision. This is not a positive compliance score. |
Read the RAG result properly
A red result identifies a priority gap or a critical uncertainty. Amber identifies incomplete implementation or evidence that needs checking. Green means the applicable controls were self-reported as evidenced. Unanswered or unevidenced areas cannot become green. An excluded area remains distinct.
The progress percentage measures completion of the questionnaire, not compliance with the law. The assessment is not an ICO certification and no percentage can establish legal compliance.
Set realistic priorities
Suggested 7, 30 and 90-day targets help plan remediation. They are not statutory extensions or safe periods. An ongoing incident, unlawful processing or high-risk activity may require immediate action. Breach notification and rights-request deadlines must be managed separately.
Complete the evidence work
- Document review: compare approved policies, contracts, notices, registers and training records with the current processing.
- Staff interviews: ask people to show how they identify requests, escalate incidents and follow retention rules.
- Data-flow mapping: trace collection, use, storage, disclosure, overseas access, retention and deletion.
- Sample testing: choose a documented sample, preserve the testing rationale and record exceptions and limitations.
- Management review: assign actions, secure resources, approve residual-risk decisions and verify completion.
Storage and exports
Answers start in memory. An optional “remember on this device” control stores them in this browser. JSON exports let you continue later; CSV exports support action management. Local downloads may contain sensitive operational details, so keep them in an appropriate location and use references rather than personal records.
From a control to a verified action
A useful review leaves a traceable chain. Record the control, the evidence examined, what the evidence establishes, what remains unknown, the action owner and the check needed to close the action.
| Step | Example record | Completion test |
|---|---|---|
| Control | Former staff access is removed from the case-management system. | The control has an owner and a defined trigger. |
| Evidence | Leaver checklist reference L-014 and a dated user-access export. | The records describe the same person, system and relevant period, using references in this tool. |
| Finding | The checklist is complete, but the access export has not yet been checked. | The uncertainty remains visible; the policy alone cannot establish execution. |
| Action | System owner compares the access list with the authorised leavers record and resolves exceptions. | An owner, date and required completion evidence are recorded. |
| Verification | A reviewer records the comparison and any follow-up, then updates the finding. | The closure decision follows the evidence and retains the original limitation. |
This fictional example explains the working method. It is not evidence of a completed client audit or a research dataset.
Apply the benchmark to the organisation
The ICO describes its full Data Protection Audit Framework as designed for large organisations. A small organisation should begin with the ICO’s small-business resources and select proportionate checks for its actual processing and risks. This site’s questionnaire is an independent working aid, not an official ICO audit or a substitute for scope-specific review.
Read the ICO framework’s scope (opens in a new tab) and the ICO’s small-organisation guidance (opens in a new tab).
Sources and version
Question set version 1; working interface edition 2, reviewed 1 November 2026. The review draws on the ten source-linked topic guides and the ICO Data Protection Audit Framework.
Content update — 2 November 2026: added an evidence-to-action example and clarified the ICO audit framework’s scope. The existing legal-source baseline is 1 November 2026.