Data privacy compliance audit

Audit - Essentials

Particularly suited to small businesses, start-ups and sole traders, this package is a relatively quick and straightforward audit of your data governance, comprising the following:

• A short form questionnaire to be completed by you to support our understanding of your business. This enables us to assess existing accountability and to ascertain any steps required to achieve compliance. Our review will include, for example:
  • The role of the business and its compliance with data privacy legislation, particularly the Principles under the UK GDPR and to ascertain the relevant lawful bases of processing;
  • Establishing all categories of personal data collected and processed by your business;
  • The nature of processing activity the business undertakes and any connected third parties (e.g. suppliers, customers);
  • Identifying all required policies and procedures including the management of data subject rights; and
  • Your existing personal data breach management process.
• The provision of a RAG rated audit outcomes report, evaluated against key compliance measures, which acts as a gap analysis and illustration of potential risks to your business;
• A roadmap to compliance. This sets out clearly defined actions which must be taken to achieve compliance. This will be presented in such a way to confirm those recommendations essential to compliance, and any optional measures which may provide further reassurance to stakeholders of your business.  

Audit - Standard 

A more comprehensive audit process than that within Essentials, this audit package is likely to suit:

• Medium to large businesses;
• Smaller businesses processing a high volume of personal data or where the processing is of a sensitive nature; and/or
• Businesses that require a full review of their existing governance measures. 

This Standard package will provide your business with:

• All services referred to within the Essentials package above; and
• The provision of a tailored questionnaire, created specifically for your business and to address all aspects of data privacy compliance, to be completed by you; and
• A full review and analysis of the effectiveness of:
  • Any existing data privacy related policies and procedures within your business; and
  • Contractual obligations imposed on you and any third parties with whom you have data sharing and/or processing arrangements; and
  • The provision of template policies and procedures to be adapted for your business.

Audit - Premium 

Our most detailed and bespoke compliance audit programme is aimed at larger businesses processing a high volume of personal data, particularly those processing a high volume of special category data or those with multi-jurisdictional presence. 

Our approach is to audit each function of the business, as determined as being necessary with you (most commonly identified as HR, Operations, Finance and Marketing) enabling a forensic approach to compliance. Results of these are then brought together from which we provide a high level view as to associated risks across the business.  

Our Premium offering includes all services within Essentials and Standard with the addition of;

• Onsite visit(s) as required;
• The provision of tailored questionnaires to be completed by each identified function of the business (which may be completed with us during an onsite visit);
• A RAG rated audit outcomes report to be delivered to each of those functions, in the form described above.

In addition, each Premium audit will deliver:

• A further executive summary report, collating all identified risks and recommended compliance measures at a high level, often useful to inform Board as to the level of compliance across the business;
• Full data mapping service for each business function in which all personal data flows are recorded and which can then continue to be maintained by the business;
• Analysis of the effectiveness of data privacy related contractual obligations to and from third parties, together with updates to these where recommended and agreed by you;
• A full update of all data privacy related policies and procedures, including those relating to individuals’ rights and data breach management.
• Staff training on a range of topics which can be delivered either in person or via Teams, as preferred by you.

Where can you find out more information?

If you’d like to discuss how our auditing packages may support your business, or to explore our complete range of data privacy support services, please contact Claire Halle-Smith.