PRACTICAL GUIDANCE
What this review is for
A scoped review of how personal information is collected, used, shared, protected and retired. Connect privacy statements to operational evidence and identify decisions that need legal or specialist assessment.
Who this is for. For organisations reviewing privacy arrangements, onboarding significant suppliers, changing services, or bringing a privacy management system into line with day-to-day processing.
SERVICE SPECIFICATION
Scope and evidence
What the review covers
- Map selected processing activities and assess the organisation’s controller, joint-controller or processor role for each.
- Review the stated purposes, lawful-basis reasoning, transparency and relevant records of processing.
- Test samples of rights handling, retention, incident escalation and supplier oversight.
- Review how security, high-risk processing assessments and international-transfer decisions are governed.
- Identify uncertainty, missing evidence and matters requiring focused legal advice rather than an unsupported compliance conclusion.
Evidence to prepare
- An outline of personal information flows, systems, recipients and storage locations.
- Privacy notices, processing records and documented lawful-basis decisions.
- Processor agreements, supplier reviews and relevant transfer assessments.
- Redacted examples of rights requests, incidents, retention decisions and DPIAs.
- Role descriptions, staff training records and management oversight of privacy risks.
What the review is intended to produce
- A processing and responsibility map for the agreed scope.
- An evidence-based findings register with priority and impact explained.
- A practical action plan distinguishing process changes from legal questions.
- An index of records and decisions needed to demonstrate accountability.
- A list of residual uncertainties and recommended specialist follow-up where appropriate.
How the work is structured
Understand the processing
Start with actual data flows and decisions. An organisation may have different roles in different activities, even within one service.
Review governance and records
Compare written arrangements with the decisions, contracts and controls that support them. Use minimised or redacted evidence wherever possible.
Trace practical scenarios
Follow examples such as a new supplier, a rights request or a deletion decision. Check the handovers between privacy, technology and service teams.
Prioritise defensible action
Assign actions to the people able to change the process. Escalate material legal uncertainty and record the basis for decisions.
Service boundaries
- Certification audits are carried out by independent certification bodies, ideally accredited by UKAS. ISOaudit does not issue certificates and is independent of ISO, UKAS and certification bodies.
- A UK GDPR audit is not an ICO approval, legal guarantee or certification of compliance. ISO/IEC 27701 can support privacy management but does not prove compliance with every applicable privacy law.
- The audit brief should describe evidence without including personal records, credentials or special-category information. The proposed service does not imply a legal-advice engagement.
- This page describes a proposed service method. An audit brief records your needs; it does not place an order or confirm scope, availability or delivery terms.
The specification does not constitute an offer or an agreed engagement. Trading identity, price, availability, scope, liability and service terms must be confirmed before a paid engagement can be accepted.
Common questions
Does a privacy policy show that we comply?
A policy or notice is one part of the evidence. The review also needs to understand actual processing, decisions, operational controls and how exceptions are handled.
Are we a controller or a processor?
The answer follows the facts of who determines the purposes and means of the processing. Contract labels alone are not decisive, and the role can differ between activities.
Will the audit decide whether we need a DPO or DPIA?
Those questions can be included as scoped assessments using the relevant facts and current ICO guidance. They should not be answered automatically from headcount or an ISO readiness score.
FICTIONAL WORKED EXAMPLE
Fictional example: following a retention decision into practice
A fictional employer reviews an HR platform containing records scheduled for deletion. This educational scenario is not legal advice or a finding about real personal information.
| Criteria to establish | Establish the processing facts, applicable law, justified retention decisions and agreed audit scope. A retention period in a template is not assumed to be legally correct. |
|---|---|
| Evidence and sample | Trace selected record categories from the retention schedule to system settings, exceptions and deletion evidence. Use minimised descriptions or redacted records rather than unnecessary personal data. |
| What the evidence shows | The fictional policy gives a retention period, but the platform owner cannot locate evidence that the deletion process runs. Actual implementation is therefore unverified. |
| Next step | Resolve the factual gap with authorised personnel, check whether exceptions or holds apply and obtain appropriate legal input for uncertain requirements. Record the operating action and how it will be verified. |
The example neither sets a universal retention period nor proves a breach. An audit finding depends on verified facts, applicable duties and the agreed scope.
YOUR NEXT STEP
Make the scope concrete.
Describe your organisation, objective and constraints. Download the brief and review it before commissioning work.
Prepare an audit brief ↗SOURCES & REVIEW
Check the underlying information.
These are independent summaries and implementation suggestions, not the copyrighted standard text. Use an authorised copy of the applicable standard for its full requirements.
- ICO: determining controller and processor roles
- ICO: data protection impact assessments
- ISO: privacy information management systems
Reviewed 1 November 2026 · Next editorial review 1 December 2026 · Editorial policy
The displayed review date records an editorial source check. Named specialist review is still to be assigned for this private edition. The 2 November 2026 content update added an original fictional worked example and related guidance; source corrections are recorded in the project change log.