GDPR & Data Protection Audit

Most organisations 'did GDPR' in 2018: policies were written, privacy notices published, a spreadsheet of processing activities compiled. Then the business changed — new systems, new marketing channels, new suppliers, staff turnover — and the paperwork stood still. Data protection compliance is not a document set; it is whether what your organisation does with personal data today matches what the law and your own notices say.

Acumon's data protection audit measures that gap: we test your documented framework against observable practice, grade the exposures by regulatory and commercial consequence, and give you a remediation plan in priority order — before a complaint, a breach or a customer's due diligence does the testing for you.

The Records and the Reality

The audit starts with your Article 30 record of processing activities — and then walks the building: what systems actually hold personal data, what marketing actually goes out, what your website actually drops in a visitor's browser, what suppliers actually receive. The gap between the register and reality is where enforcement risk lives, because every downstream obligation — lawful basis, retention, security, transfer safeguards — attaches to processing you may not have documented at all.

Lawful Bases, Notices and Consent

Every processing activity needs a lawful basis that stands up, a privacy notice that discloses it, and — where consent is the basis — consent that meets the standard: specific, informed, freely given, and as easy to withdraw as it was to grant. We test the chain end to end, including the legitimate-interests assessments that were never written down and the marketing lists whose provenance nobody can evidence. Direct marketing is the ICO's most active enforcement area; it gets proportionate attention.

Rights Requests and Retention

Subject access requests are where data protection failures become visible: one calendar month, all their data, wherever it sits. We test whether a real DSAR could be answered — search capability across systems and mailboxes, exemption judgement, redaction practice — and audit retention in the same breath, because data kept forever is a DSAR, breach and storage-limitation problem compounding annually. 'We keep everything' is the single most common finding, and one of the most consequential.

Security, Breaches and Processors

UK GDPR requires security appropriate to the risk, and evidence of it: access controls on personal data, encryption where warranted, and a breach process that can detect, assess and — where required — notify the ICO within 72 hours. We also audit the supplier layer: whether processors are under Article 28 contracts, whether international transfers have valid safeguards, and whether anyone actually assessed the vendors before the data flowed. Where cyber controls need deeper testing, this audit pairs naturally with our cyber security audit.

Reporting and Remediation

You receive a graded findings report mapped to the UK GDPR principles, a remediation plan sequenced by risk, and the artefacts your framework is missing — DPIA templates, retention schedules, LIA formats — identified concretely rather than gestured at. The report is written to be shown: to your board, to a customer's procurement team, or as evidence of proactive compliance if the ICO ever asks what you did and when.

What You Get With Acumon

• Article 30 records tested against the processing that actually occurs
• Lawful bases, privacy notices and consent mechanisms audited end to end
• DSAR capability tested against the one-month, all-systems standard
• Retention practice audited — including the 'we keep everything' problem
• Security measures, breach detection and 72-hour notification readiness
• Processor contracts, international transfers and vendor assessments reviewed
• Website cookies and marketing compliance checked against PECR
• Graded findings mapped to UK GDPR principles, with a sequenced fix plan

Why Acumon for GDPR & Data Protection Audit?

• Partner-led delivery by a Chartered Member of the Institute of Internal Auditors (CMIIA)
• IT risk practice covers GDPR compliance assessment as a core discipline
• Cross-sector experience with flexible engagement models and rapid mobilisation
• Board-focused reporting that feeds your wider assurance framework

Get a Fixed-Fee Quote

Tell us what you need and we'll come back within one business day with a clear scope and a fixed price — no hourly-rate surprises. Call 020 8567 3451 or use the form and we'll be in touch.