Data Protection Audit: How to Assess Where Your Business Really Stands

Quick answer: A data protection audit is a structured check of how your business collects, uses, shares and protects personal data, measured against UK GDPR. Run it in steps: map your data, check lawful bases, review policies and consent, assess suppliers and test incident readiness. Then turn the gaps you find into a prioritised fix list, and repeat it at least once a year. Trust Keith runs a free, no-obligation audit that does exactly this.

Why Scale-Ups Find Gaps They Didn't Know Existed

Ask most scale-ups whether they're "basically fine" on data protection, and you'll get a confident yes. Ask to see the evidence, and things get a bit quieter.

That's not a failing, it's what growth does. Teams add tools, suppliers, new features and new hires faster than anyone updates the paperwork. 

Then there's the stakes. The government's Cyber Security Breaches Survey 2025/2026 found that 43% of businesses reported a breach or attack in the last 12 months. Data protection isn't a theoretical risk for a growing business. It's a "when did we last check?" question.

An audit answers that question properly. Not with a feeling, but with a list of what's working, what isn't, and what to do first. It's also the thing investors, enterprise customers and regulators tend to ask for when they want proof rather than reassurance.

The good news is that most gaps are fixable, and fixable fast, once you can actually see them. The bad news is that you can't fix what you haven't found.

What a Data Protection Audit Actually Covers

So, what's actually in scope? Short answer: anywhere personal data is touched. Longer answer: it depends on your business, but a proportionate audit for a scale-up usually looks at six areas.

• Data inventory and mapping, what personal data you hold, where it lives, who can access it and where it goes next.
• Lawful bases and transparency, whether every use of personal data has a valid reason behind it, and whether your privacy notices say what you really do.
• Policies and governance, who owns data protection, what's written down, and whether anyone actually follows it.
• Consent and marketing, cookies, email permissions and how you record and honour opt-outs.
• Suppliers and international transfers, which third parties handle your data, whether contracts are in place and where data ends up geographically.
• Incident readiness and individual rights, whether you can spot a breach, escalate it and answer a subject access request on time.

Notice what's not on that list: a giant binder of policies nobody reads. A good audit looks at what happens in practice, not just what's on paper. A beautifully written retention policy means very little if customer data from 2019 is still sitting in a shared drive.

It's also worth saying that scope should match the business. A fintech handling payment data and a HR tech platform processing employee records will have different priorities. Same framework, different emphasis.

How to Run a Data Protection Audit, Step by Step

Here's the process that tends to work. Six steps, in this order, because each one feeds the next.

1. Build the data inventory

Start by listing what you collect, why, where it's stored, who sees it and who you share it with. Talk to the people who actually use the data, not just whoever owns the policy. Marketing, product, HR and finance will each tell you something the others won't.

This inventory is the backbone of your record of processing activities too. The ICO's records of processing and lawful basis toolkit is a useful reference for what regulators expect to see documented.

2. Check your lawful bases

For every processing activity, ask: what's our legal reason for doing this? Contract, legitimate interests, consent, legal obligation? If the honest answer is "we've always done it", that's a gap. Check your privacy notices against the inventory while you're there. Do they match?

3. Review policies and governance

Do the core policies exist, are they current, and do people know about them? Look at who's accountable for data protection, how decisions get made, and whether training has actually happened. Evidence matters here. "We do it" and "we can prove we do it" are very different things.

4. Test consent and individual rights

Check how cookies and marketing permissions are captured and stored. Then run a dummy subject access request through your process and see how long it takes. If nobody's sure who'd pick it up, you've found a gap before a customer does.

5. Assess your suppliers

List every supplier that touches personal data. Check there's a data processing agreement in place for each one, that it covers what UK GDPR requires, and that you know where the data goes. This is where audits most often turn up surprises.

6. Test incident readiness

If something went wrong tomorrow, would your team spot it, escalate it and make the call on reporting? The clock is tight. Under Article 33 of UK GDPR, a reportable breach needs to go to the ICO within 72 hours of you becoming aware of it. A walkthrough exercise, even a short one, shows quickly whether your process holds up under pressure.

What Trust Keith's Free Data Protection Audit Includes

Here's the bit where we practise what we preach. Trust Keith offers a free GDPR and data protection audit, and it follows the same logic as the process above. You can see the full detail and book it here.

It's free, there's no obligation, and a senior data protection expert runs it from start to finish. Here's what you get.

• A gap analysis against a 48-control framework, so you can see which controls are missing, which are weak and which are already solid.
• An audit-ready report, with risks ranked by priority. It's built to be used as evidence for due diligence, a funding round or a customer questionnaire.
• Senior-led delivery, the expert runs the audit, builds the report and walks you through it.
• Broad scope, covering data mapping, vendor and third-party risk, policies and documentation, breach readiness, data subject rights and international transfers.

How it works

Four steps, and none of them needs a week of your calendar blocked out.

1. Book your free audit. Arrange a call and tell the team about your business.
2. Answer the questionnaire. You complete it at your own pace, covering how data is handled today.
3. Your expert builds the report. They score your answers against the framework.
4. Results call. You go through the report together, so you know exactly where you stand.

It's particularly useful if a deal, a funding round or a board is about to ask for proof. Better to find the gaps yourself than have somebody else find them for you.

Data Protection Audit vs Gap Analysis: What's the Difference?

These two get mixed up constantly, so let's separate them.

An audit asks, "what are we actually doing, and is it compliant?" It's a fact-finding exercise. It looks at your current state and checks it against the rules.

A gap analysis asks, "what's missing between where we are and where we need to be?" It starts from a target, such as UK GDPR, a customer's security questionnaire or an investor's due diligence list, and measures the distance.

In practice, they overlap a lot. Many businesses do an audit first to establish the baseline, then a gap analysis to plan the route to a specific standard. Others skip straight to the gap analysis because a deal or a deadline demands it.

Trust Keith's free audit blends the two: it checks what you're doing today and scores it against a defined set of controls. Both audits and gap analyses are one-off projects with a clear start and end. That's different from the ongoing work that comes after, where someone keeps the remediation moving and the records current. The audit tells you what to fix. It doesn't fix it for you.

How Often Should You Audit?

"Annually" is the usual answer, and it's a sensible starting point. But a calendar isn't the only trigger.

Run a fresh review, or at least a targeted one, when something material changes. A new product that uses personal data in a new way, a big supplier switch, a move into new markets, a funding round, a breach or a near miss. Each one changes your risk, and the last audit won't have caught it.

It's also worth remembering that the ICO can come to you. Under section 146 of the Data Protection Act 2018, the Commissioner can issue an assessment notice requiring an organisation to allow an inspection of its data protection practices. You don't want your first look at your own compliance to be one you didn't choose.

A rhythm that works for many scale-ups: a full audit once a year, a lighter quarterly check on the biggest risks, and a focused review whenever something big changes. Less dramatic than a panic audit. Much cheaper, too.

What to Do With Your Audit Findings

The audit report isn't the finish line. It's the starting gun.

The most common mistake is producing a long list of findings and then letting it sit. So triage straight away. Sort every finding by two things: how much risk it carries, and how hard it is to fix.

• High risk, quick fix, do these this week. A missing supplier agreement or an out-of-date privacy notice usually lives here.
• High risk, bigger job, plan these properly, with an owner and a date.
• Lower risk, quick fix, batch them and clear them off.
• Lower risk, bigger job, schedule them, and revisit at the next review.

Give every action a named owner and a deadline. "The team will look at this" isn't an owner. Then track progress somewhere everyone can see it, and record what you've done. Evidence of remediation matters just as much as the finding itself, especially when a customer or investor asks what you did about it.

This is also where an expert earns their keep. Someone who's seen the same gaps in dozens of businesses can tell you which ones matter and which ones just look scary on a spreadsheet.

Frequently Asked Questions

What is a data protection audit?

A data protection audit is a structured review of how your organisation collects, stores, uses and shares personal data, checked against UK GDPR and the Data Protection Act 2018. It produces a clear picture of what's compliant, what isn't and what to fix first.

How long does a data protection audit take?

It depends on the size and complexity of your business. Most of the time goes on gathering information from different teams, not on the analysis itself. With Trust Keith's free audit, you complete the questionnaire at your own pace, and it's worth asking the team about timing when you book.

Is a data protection audit a legal requirement?

UK GDPR doesn't use the word "audit" as a standalone obligation. But it does require you to show you comply, which means regular checking is the practical way to meet that. Many customers and investors also ask for audit evidence as part of due diligence.

What's the difference between an audit and a gap analysis?

An audit checks what you're doing now against the rules. A gap analysis measures the distance between your current position and a specific target, such as UK GDPR compliance or a customer's requirements. Many businesses do both, in that order.

Is Trust Keith's data protection audit really free?

Yes. It's free with no obligation. You get a gap analysis against a 48-control framework, a prioritised audit-ready report and a results call with a senior data protection expert.

Who should run the audit?

It can be done internally, but it's easy to miss your own blind spots. An independent, experienced reviewer brings fresh eyes and knows where the common gaps hide. Either way, someone senior needs to own the outcome so findings turn into action.

An audit isn't about finding fault. It's about knowing where you stand, so the next conversation with a customer, investor or regulator is a calm one.

If you'd like to go deeper on the pieces that feed into an audit, these are good places to start: our GDPR audit checklist for fintechs, the wider GDPR compliance checklist for UK scale-ups, and our guide to preparing for privacy due diligence. For the building blocks, see how to build and maintain your ROPA and how to manage your supplier chain and data processing agreements. If you're wondering what happens when the regulator comes knocking, there's a piece on preparing for an ICO investigation, and one on the hidden costs of getting data protection wrong.

If you'd like help keeping findings moving after the audit, see our dedicated DPO service.

If any of this still feels uncertain, or you'd like to talk it through with someone who's handled this before, you're welcome to book a free audit with our team. No pressure, no obligation. We're happy to see how we can help.