Ask for a GDPR assessment and UK providers might quote for a one-hour call or a six-week project. That’s because “GDPR audit” and “GDPR review” get used as if they mean the same thing. They don’t, and neither term is defined in law.
Knowing the difference helps you ask for the right thing, pay for the right amount of work, and get an outcome you can use. A quick check suits some situations. Others need evidence that stands up to scrutiny.
What Is a GDPR Review?
A GDPR review is a light-touch, advisory check. It looks at one area of your data protection work, or takes a quick read across several, and tells you whether anything looks wrong.
A review might focus on:
- Consent: whether your forms, cookie banner and marketing opt-ins collect valid consent
- Privacy notices: whether they give people the information required by UK GDPR Article 13 and Article 14
- Staff training: whether people know how to spot a breach or a subject access request
- Breach procedure: whether your team knows who to tell and how fast
A review relies on conversations and a sample of documents rather than testing. Findings might come back verbally or as a summary, and the work costs less and finishes sooner than an audit.
A GDPR compliance review is a good sense-check when you want to know whether a specific area needs attention. It isn’t evidence that you’re compliant.
What Is a GDPR Audit?
A GDPR audit is formal, documented, and evidence-based. Instead of asking whether things look right, it tests whether what you do matches what your policies say, and whether both match what the law requires. Some providers call it a GDPR compliance audit, but the substance is the same.
An audit covers an agreed scope. That can mean all of your processing activities, or the business unit, system or set of processes that carries the most risk.
What the auditor examines:
- processing activities and your record of processing
- technical and organisational measures, such as access controls, encryption and retention
- contracts with processors and other third parties
- training records
- breach logs and subject access request logs
The audit ends with a written gap report and a plan for fixing what it finds.
Internal or external? You can run a GDPR internal audit with your own compliance team, or bring in an external auditor. An internal audit costs less and builds in-house knowledge. An external one brings independence, which matters if the findings will go to a board, an investor or a regulator.
Whichever route you take, the ICO’s data protection audit framework is a useful benchmark. It sets out nine toolkits covering the areas the regulator looks at in its own audits, starting with accountability. The ICO designed it for larger organisations and points small businesses to its self-assessment resources instead.
When Should You Get a Review vs an Audit?
What’s prompting the question, and who will read the answer, decides which one fits. The table below matches common situations to the better option and the reason for it.
| Situation | Better fit | Why |
|---|---|---|
| You’re new to GDPR and want a starting point | Review, then audit | A review shows where the biggest gaps are, and an audit then gives you a full baseline |
| You’ve had a personal data breach | Audit | You need to show the root cause, what you changed, and that other areas aren’t affected |
| The ICO has contacted you about a complaint or inquiry | Audit | A regulator expects documented evidence, not a verbal opinion |
| You’re buying or selling a business, or raising investment | Audit | Due diligence calls for written findings on how the business handles personal data |
| You want to check one process before a launch or campaign | Review | A focused check is quicker and costs less |
| A client has sent a data protection questionnaire | Review or audit | A review covers short questionnaires, while detailed ones need audit evidence |
Both can produce a GDPR gap analysis. The difference is depth: a review’s gap analysis reflects what people told the reviewer, while an audit’s reflects what the auditor tested.
What Does a GDPR Audit Actually Cover?
The six areas below form the core of a GDPR audit checklist. Each one tests a different link between your paperwork and what happens day to day.
- Document review: Policies, privacy notices, records of processing, DPIAs, retention schedules, and earlier audit reports. The auditor checks that they exist, that they’re current, and that they agree with each other.
- Data mapping validation: Your data map or record of processing is checked against how data actually moves through your systems, integrations and suppliers. Gaps show up here when new tools get added faster than records get updated.
- Staff interviews: Conversations with the people who handle data, such as HR, marketing, developers and system administrators, to understand how processing works in practice.
- System checks: A review of access controls, encryption, retention settings and logging, to confirm that the measures in your documents exist in your systems.
- Supplier contract review: Processor contracts are checked for the terms required by UK GDPR Article 28, and transfers outside the UK are checked for a valid transfer mechanism.
- Training records: Who has been trained, when, and whether the content fits their role.
In a UK GDPR audit, the benchmark is UK GDPR and the Data Protection Act 2018. If you also process data about people in the EU, the auditor can test against the EU GDPR as well, since the two regimes differ in places.
What Do You Get at the End?
A review might end with a conversation. An audit ends with documents you can act on and share with others who need to see them:
- Gap report: What the auditor tested, what they found, and which legal requirement each gap relates to.
- Risk-rated findings: Each gap rated by severity, so you can see what carries real regulatory risk and what’s administrative.
- Remediation roadmap: Prioritised actions, each with an owner and a suggested timescale.
- Executive summary: A short version for your board or leadership team.
An audit tells you what to fix. Making the fixes is a separate piece of work, which your team can take on or bring in outside help for.
How Often Should You Audit?
UK GDPR doesn’t set a fixed audit frequency, but it does expect ongoing checks. Under Article 5(2), you must be able to show that you comply. Article 24(1) says your measures should be reviewed and updated where necessary, and Article 32(1)(d) asks for a process to regularly test, assess and evaluate your security measures.
We recommend a full audit once a year as a default, with a lighter review in between if your processing hasn’t changed much.
Some events justify an audit outside that cycle:
- a personal data breach
- a major system change, such as a move to a new platform or cloud provider
- entering a new market, particularly one with its own data protection law
- a merger, acquisition or restructure
- a new DPO starting who needs an accurate baseline
Ready to Book a GDPR Audit?
If you need evidence rather than reassurance, an audit is the right call. Our GDPR audit service covers an agreed scope, tests your documents against your systems, and ends with a risk-rated roadmap. Get in touch, and KEWDATA will help you agree on the scope that fits your organisation.
