Covers the whole data protection arrangement in one audit, from records and retention to rights, breaches and the use of AI.

Effective Audit Checklists

Prepared using the F-Q2A Audit Checklist form template.

The file is supplied in fully editable MS Word format and can be easily customised, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Checklist number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested audit checklists. No junk, jargon or unnecessary questions. Simple and usable audit checklists developed over 25 years through practical use in the real world.

Further Reading

Further guidance on auditing data protection:

• Data Protection and UK GDPR
• ISO 42001 Annex A.9 - Use of AI Systems
• Information Security Awareness and Training
• Internal Auditing knowledge base

Logo Update Service

Download this audit checklist template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription. This checklist is also included in the GDPR / Data Protection Toolkit and the ISO 9001, ISO 14001, ISO 45001, ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them, so the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like hands-on help reviewing your data protection arrangements or preparing for internal audits, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Data Protection Audit Checklist Template

A process audit checklist for auditing an organisation's data protection arrangements. Based on the alphaZ F-Q2A audit checklist format, it records the scope, criteria, auditors and date, with each question alongside the auditee and the evidence viewed, response and findings.

Areas Covered

• Identification of Personal Data, and Management of Records and Processing Activities
• Data Retention and Deletion, and Policies
• Information Commissioner's Office (ICO) Registration, and Awareness / Training
• Privacy by Design, and Data Protection Impact Assessments for higher risk processing
• Use of AI, and Automated Decisions
• Consent, Data Subject Access, and Complaints
• Transfer of Personal Data, and Transfer abroad
• Data / Information Security, and Data Breaches

Using the Checklist

Use it for a scheduled internal audit of data protection, or as a review after a change such as introducing AI tools. It can also be used to train staff for internal audits.

Included in the GDPR / Data Protection Toolkit

This checklist is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download, and is also included in the ISO 9001, ISO 14001, ISO 45001, ISO 27001 and ISO 22301 toolkits.

Works with the Compliance Checklist

For a self-assessment rather than an audit, the F-Q106 Personal Data Protection Compliance Checklist covers the same ground with space to record arrangements and actions.

Working Through the Audit

Each area has space for the auditee, the evidence viewed and the findings. Look for the records that show each arrangement works in practice - the personal data register, completed request and breach forms, training records, impact assessments and supplier agreements - rather than relying on the policy alone.

Recording Findings

Record any gaps as findings and raise actions through your usual issues and actions process, so they are followed up and closed.

Who Should Carry Out the Audit?

Anyone trained in internal auditing who is independent of the area audited. The checklist is laid out so a less experienced auditor can follow it, and the answers give management a clear view of how well data protection is working.

Planning the Audit

Include data protection in the internal audit schedule, and audit it again after a significant change such as a new system, a new supplier handling personal data or the introduction of an AI tool.

After the Audit

Share the completed checklist with the person responsible for data protection, agree who will complete each action and by when, and check at the next audit that the actions were effective.

Related Documents

Other documents in the GDPR / Data Protection Toolkit that work alongside this one:

• A-C_P45 Personal Data Audit Checklist
• F-Q106 Personal Data Protection Compliance Checklist
• PP-1-16 Data Protection Policy Procedure
• F-IMS24 Personal Data Register

Preparing for the Audit

Before the audit, gather the data protection policy and procedure, the personal data register, the privacy notices, and any request, breach and impact assessment records. Reading them first lets the audit focus on whether what is written matches what happens.