Detailed Audits and Gap Analysis
A structured review of your data protection practices against UK GDPR, the DPA 2018 and sector guidance. The output is a clear, prioritised action plan, not a risk register that sits on a shelf.
Know where you stand and what to do
Our audits are built around your organisation and not a generic template. We review your documentation, processes and systems against the ICO accountability framework.
The output is a realistic, prioritised action plan. We tell you where you’re compliant, what needs to change, what is good practice, and what can wait. This means your compliance resource can go where it is most needed.
What you receive
At the end of every audit, you receive a written report with every finding rated by priority. You will know what needs immediate attention, what can wait, and what you are already doing well. The action plan comes with realistic timescales, not an aspirational to-do list.
If you need us to present the findings to your board or senior management, we do that too. And if you want support working through the actions afterwards, we are available for that. The report is action-oriented rather than simply documenting the current status.
The accountability principle
Article 5(2) of UK GDPR requires organisations to demonstrate compliance, not just comply. An audit produces the documented evidence that the ICO would expect to see in an investigation or following a complaint. Starting with a documented baseline makes future compliance work significantly more efficient.
Specialist audits for specific needs
In addition to full compliance audits, we conduct focused reviews when a specific area requires attention.
Often triggered by a complaint, a regulatory enquiry, when a new client asks for evidence of compliance or if you’re selling the business.
DSAR process review
A targeted assessment of your Data Subject Access Request (DSAR) handling. From initial receipt through to response drafting and exemption decisions. We review your process against ICO guidance, identify any gaps and reduce the risk of any ICO complaints.
Marketing & PECR Audit
A review of your electronic marketing practices against Privacy and Electronic Communications Regulations (PECR), UK GDPR and ICO enforcement guidance. Covering consent mechanisms, soft opt-in, preference management, third-party data sourcing and unsubscribe compliance. The ICO’s enforcement activity in this area has increased significantly.
Supplier & processor due diligence
An assessment of your processor and sub-processor arrangements. Article 28 compliance, DPA documentation, security questionnaire responses and ongoing monitoring obligations. Increasingly required before new client and public sector contracts are signed.
International transfer review
A focused review of your cross-border data flows. Identifying transfers, assessing whether the right safeguards are in place, and producing a plan to put things right where documentation or assessment falls short of the International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCC) requirements.