Define the assurance question
A data-protection audit should begin with the question you need answered. A management gap assessment, review of a particular customer journey and evidence-based compliance audit have different scopes. State whether the work covers one business unit, one system or the organisation's processing activities.
Registration assistance, a legal audit, a DPIA and a technical penetration test are not interchangeable services. A project may need several of them, but each should have a purpose and appropriate professional input. Avoid accepting a certificate or a generic policy pack as proof that the entire operation has been assessed.
Ask for an evidence-based work plan
- Map the processing activities and roles in scope.
- Review relevant notices, policies, contracts and records.
- Interview staff responsible for the actual processes.
- Sample how collection, access, retention and deletion work.
- Assess rights handling, incidents, vendor management and overseas arrangements as relevant.
- Report findings, evidence, limitations and prioritised corrective actions.
The sampling method matters. An organisation with several branches or disconnected systems needs a clear explanation of which locations and records were examined. A finding should distinguish a missing policy from a control that exists on paper but is not followed.
Understand what determines the fee
The cost depends on the breadth and complexity of processing, number of locations and systems, sensitivity of data, record quality, access to staff and the deliverables required. Remediation drafting, technical testing and follow-up verification may need separate work.
Give the adviser a realistic description of the operation before requesting a fixed proposal. Ask for assumptions about interviews, sample sizes, workshops, revision rounds and the final report. Compare quotations on those deliverables rather than a headline price alone.
Turn the report into an action plan
Each finding should have an owner, action, priority and target date. The business needs to understand which actions depend on legal drafting, technical changes, vendor negotiations or staff practice. A report that lists gaps without assigning responsibility is difficult to implement.
Agree whether the engagement includes a management discussion, action-plan workshop or a later check of completed fixes. Establish how evidence is stored, who can access it and when working copies are deleted. Audit preparation should not create another uncontrolled collection of personal data.
Begin with a proportionate brief
Prepare a high-level activity map, systems and branches in scope, previous assessments and the reason for the review. Do not attach actual customer or staff records to a general enquiry. The firm can agree confidentiality and secure access before reviewing evidence.
A focused consultation can help distinguish a registration need, a limited review and a wider compliance project. The resulting proposal should identify scope, outputs, exclusions and any specialist work. Registration costs and professional audit fees should remain separate budget lines.
Official sources and further reading
Related legal services
Discuss the next step
Request a focused consultation on this issue. The firm will confirm conflicts, scope, availability and the fee before accepting the appointment.
This guide provides general information, not legal advice, and does not create an advocate-client relationship. The appropriate route, applicable law and current official procedures should be checked for your circumstances. Do not send confidential documents through the enquiry form.