GDPR audit without the scattered evidence.
Most privacy audits fail when the regulator asks for proof and the evidence is in three tools. This template runs ten control areas in one process with three approval gates that make the audit trail the audit trail.
For privacy officers, dpos, and compliance leaders. No credit card. First run in under a minute.
Privacy Audit #GDPR-2025-Q4
GDPR + CCPA · 10 control areas · DPO sign-off required
- Define audit scope100%Privacy OfficerApproval gate
- Records of processingBLOQUEADAData EngineerEvidence
- DSAR pipeline testBLOQUEADAPrivacySLA 30d
- Consent verificationBLOQUEADAEngineeringIn parallel
- Article 28 contractsBLOQUEADALegalIn parallel
- Cross-border transfersBLOQUEADALegalIn parallel
- Breach notification testBLOQUEADAPrivacyEvidence
- Synthesize findingsBLOQUEADAPrivacy OfficerApproval gateDep. pendente
- Executive briefingBLOQUEADALegal + CEODep. pendente
- DPO sign-offBLOQUEADADPOApproval gateDep. pendente
Opinion
What we cut. And what we kept.
This template is complete, not exhaustive. Exhaustive is why audits take six months.
Cut
- Consent records in one tool, DSARs in another.
- Breach drills nobody documented.
- Article 28 contracts in a shared folder.
- Cross-border evidence assembled when asked.
Kept
- Ten control areas tested in one process.
- Privacy Officer approval before executive brief.
- Legal + CEO briefing for critical findings.
- DPO sign-off gate before close.
What this template includes
Process steps
- 1Define audit scope, applicable regulations (GDPR, CCPA, both), and in-scope data systems, Privacy Officer gate
- 2Build records of processing: data categories, lawful basis, retention windows, and system locations
- 3Test the DSAR / consumer-rights pipeline end to end with response-time evidence
- 4Verify consent capture, storage, and revocation paths across web, app, and email
- 5Review Article 28 contracts and subprocessor flow-down for every active processor
- 6Confirm SCCs, BCRs, adequacy decisions, and transfer impact assessments where data crosses borders
- 7Validate breach detection, triage, and 72-hour notification capability with a tabletop scenario
- 8Synthesize findings into a single nonconformance grade, Privacy Officer gate
- 9Legal + Executive briefing for critical findings (regulator notification on the table)
- 10Final DPO sign-off and handoff to remediation tracking, DPO gate
Why teams use this template
Privacy audits go wrong when the evidence is scattered. Consent records live in one tool, DSAR responses live in tickets, breach drills happened a year ago and no one remembers who attended. When the regulator asks, you have a week to assemble what should have been continuously documented, and the gaps you find are usually the gaps the regulator finds.
This template runs the full GDPR/CCPA audit cycle as one process: scope, evidence collection across ten control areas, gap analysis, executive briefing for critical findings, and DPO sign-off. Three checkpoint gates make it impossible to close the audit without the evidence in place, and the run history is the documentation auditors want to see.
Multi-stakeholder by design: Privacy Officer leads, Legal Counsel reviews DPAs and cross-border controls, Data Engineer maps records of processing, and DPO + CEO co-sign when regulator notification is on the table. No single point of failure. No "I thought you handled it."
Ready to run this process?
Open this template in Cadenio, customize the fields and approvals for your context, and run it for the first time in under 60 seconds.
Related use case
Financial Compliance use caseRelated templates
ISO 27001 Internal Audit
ISO 27001 internal audit template, Annex A control sampling, ISMS clause review (Clauses 4–10), CAPA execution, and CISO sign-off. Nine-step audit aligned with ISO 27001 requirements.
ComplianceThird-Party Risk Assessment
Third-party risk assessment template, tier classification, due-diligence pack, four risk dimensions (operational, reputational, financial, compliance), and CRO sign-off for critical vendors.
ComplianceData Retention Policy Review
Data retention policy review template aligned with ISO 27001, SOC 2, GDPR, and LGPD: data-class inventory, retention assessment, disposition decisions, evidence-backed deletion, and DPO sign-off. Six-step auditable review.