How to conduct a GDPR compliance audit

Australian organisations often handle personal data from customers, employees, suppliers and visitors in the European Economic Area. Even without an Australian office in Europe, GDPR can apply when a business offers goods or services to those people, monitors their behaviour, or acts as a processor for a European organisation.

A useful compliance audit tests whether privacy commitments match actual practices and produces evidence for accountable decision-makers. It examines the full data lifecycle, legal bases, vendor arrangements, security safeguards, rights handling and breach readiness rather than relying on a signed privacy policy.

Establish the audit scope

Start with a written applicability assessment. Record ecommerce checkouts, EU customer support, travel data, advertising pixels, app telemetry, analytics and outsourced processing. Identify whether the organisation acts as a controller, joint controller or processor for each activity.

If there is no EU establishment, determine whether an EU representative is required, subject to limited exceptions. Record any representative, lead supervisory authority and data-subject locations. A provider processing data solely under documented instructions may have a different role from a business deciding its own purposes.

Set boundaries by legal entity, system, business unit, data category and purpose. Include Australian-hosted workloads, cloud regions and subprocessors. Justify exclusions such as basic corporate contact records, and revisit them when products, markets or data uses change.

Build criteria, ownership and evidence

Translate GDPR principles into testable criteria: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Add sector standards, contractual requirements and Australian privacy rules where the Privacy Act 1988 applies.

Assign an executive sponsor, audit lead and owners across legal, security, data governance, procurement, HR and marketing. Confirm whether a DPO is mandatory and involve the privacy or compliance function regardless. Give every finding a named owner.

Request policies, configurations, contracts, consent records, access reviews, training, incident exercises and prior risk assessments. Sample real records and transactions. Questionnaires show that controls are described; samples help show that they operate.

Map the personal data lifecycle

Create a data-flow map from collection through use, disclosure, storage, archiving and deletion. For each flow, identify fields, data subjects, source, purpose, lawful basis, retention period, storage location and recipient. Pair it with a processing record and reconcile naming differences across teams.

Inventory ecommerce platforms, CRM tools, HR systems, support desks, mobile apps, websites, APIs, backups and endpoints. Look for advertising pixels, analytics tags and temporary exports, which often persist beyond the business process that created them.

Document where information resides, including Australian providers and offshore support access. Sydney, Melbourne and Brisbane hosting may support latency and procurement policies, but location does not change GDPR obligations. Review whether remote access from another country constitutes a restricted transfer.

Test lawful use and individual rights

For each significant purpose, test the lawful basis and whether processing is necessary and proportionate. Do not treat consent as a default. Check that withdrawal is as easy as consent and that contractual necessity genuinely relates to service delivery rather than convenient retention.

Review notices against actual collection, recipients, retention and transfers. Where sensitive data such as health information is processed, document the additional condition and safeguards. Marketing must also meet applicable Privacy Principles and the Australian Spam Act 2003.

Test the rights workflow with realistic requests for access, correction, erasure, restriction, portability and objection. Verify identity checks, system-wide searches, deadlines, exemptions and escalation. Examine automated decisions for meaningful human review or other safeguards.

Review processors, transfers and safeguards

Assess material processors and subprocessors, including payment gateways, cloud hosts, recruitment firms, support platforms and threat-monitoring providers. Check Article 28 terms, instructions, confidentiality, security duties, assistance, deletion, audit rights, breach notification and subprocessor approval.

For restricted transfers from the EEA to Australia or elsewhere, document the mechanism, such as the EU Standard Contractual Clauses, and complete a transfer impact assessment. Apply supplementary measures where needed, including strong encryption with controlled keys, pseudonymisation, least-privilege access and contractual limits on government access.

Map technical and organisational controls to configurations. Review MFA, role-based access, patching, logging, endpoint protection, backups, vulnerability management and recovery testing. Financial institutions, government agencies, healthcare providers and ecommerce operators should set risk thresholds according to data sensitivity.

Test incident response and accountability

Challenge the breach process with a tabletop involving lost credentials, misdirected records or a compromised vendor. Record containment, evidence preservation, legal assessment and decisions. A controller should be ready to notify the lead supervisory authority within 72 hours when notification criteria are met, while processors notify the controller without undue delay.

For Australian operations, assess Notifiable Data Breaches requirements under the Privacy Act and guidance from the Office of the Australian Information Commissioner. A GDPR notification decision does not replace an OAIC assessment; document both outcomes and coordinate consistent communications.

Review the processing register, DPIAs, retention schedule, security procedures, training records, processor reviews and remediation tracking. Revisit DPIAs when new technology, large-scale monitoring, special-category data or high-risk vendors enter scope. Require evidence that previous findings have closed.

Turn findings into accountable action

A compliance audit is most valuable when its report becomes a funded programme of work. Rank findings by risk to individuals, while including lower-severity gaps that expose weak governance. Record owners, target dates, dependencies, completion evidence and acceptance authority.

Use a focused remediation set to direct the next stage of work:

• Complete the processing inventory and reconcile every system, vendor and transfer.
• Document and approve a lawful basis for each significant purpose.
• Refresh notices, consent mechanisms and individual-rights procedures.
• Execute compliant processor terms and transfer impact assessments.
• Run a breach tabletop and close control deficiencies identified during the audit.
• Introduce recurring control testing with evidence retained for the next review.
• Set quarterly governance checkpoints and an annual independent reassessment.

Ask the audit team to validate critical remediation rather than accepting status reports alone. Where technical testing is required, combine the privacy review with targeted vulnerability assessment and penetration testing so that documented safeguards are compared with exploitable weaknesses.

A practical next step is to request a scoped, trial-based review from Infoziant Security, including a free VAPT report where it supports the audit. Bring the processing map, key contracts and latest risk assessment; use the findings to brief leadership, assign action owners and schedule the next compliance checkpoint.