GDPR audit for Irish businesses
GDPR Audit and Gap Analysis
A structured review of how your organisation handles personal data, with written findings and a prioritised action plan.
From €495
- Written findings your management can act on
- Gaps ranked by risk
- Fixed price agreed before we start
- Carried out remotely or on site
Request an audit quote
Business enquiries only. Tell us about your organisation and we will send a written proposal.
Prefer to talk? Call 085 804 1664.
Who this is for
Businesses that do not know where they stand
You want an honest picture before spending money on fixes.
Firms preparing for a tender or due diligence
A recent audit report shows customers and investors that you take data protection seriously.
Organisations after a change
A new system, merger or service is a good point to check your position.
Boards and owners who want assurance
An independent review gives you a baseline and a record.
What you get
Included
- Review of your policies, notices and records
- Interviews with the people who handle personal data
- Check of supplier and data-sharing arrangements
- A written report of findings ranked by risk
- A prioritised action plan
- A call to walk through the findings
Not included
- Legal advice or representation
- Fixing the gaps found (available separately as a compliance project)
- Penetration testing or IT security audit
- Certification of compliance
How it works
Scoping call
We agree which parts of the business the audit will cover.
Review
We examine documents and speak to the relevant staff.
Report
You receive written findings and an action plan, and we talk you through them.
Pricing
From €495
The price depends on the size of the organisation and how many processing activities are in scope. It is fixed and agreed in writing before work starts.
Who does the work
The work is led by Dylan Holland of Plus Promotions Limited. You deal with the same person from scoping through delivery.
What a GDPR audit checks
A GDPR audit, sometimes called a gap analysis, compares what your organisation does with personal data against what the GDPR and the Irish Data Protection Act 2018 require. It answers a practical question: if the Data Protection Commission, a customer or an investor asked you to demonstrate compliance tomorrow, what could you show them?
- Lawful basis. Whether each use of personal data has a valid legal basis that is recorded.
- Transparency. Whether privacy notices match what actually happens.
- Records and retention. Whether a record of processing exists and data is deleted on schedule.
- Rights and breaches. Whether staff know what to do with an access request or a breach.
- Third parties. Whether processor agreements and international transfers are covered.
- Security and training. Whether organisational measures and staff awareness are documented.
Questions
What do you review?
Policies, privacy notices, records of processing, retention, supplier agreements, breach and access request handling, and staff awareness.
Is it on site or remote?
Either. Most SME audits can be done remotely with document access and video calls.
What do we receive?
A written report with findings ranked by risk, and a prioritised action plan.
Can you fix what you find?
Yes, as a separate fixed-price compliance project if you want us to.
Are you solicitors?
No. This service is provided by Plus Promotions Limited, a compliance consultancy. We are not a solicitor’s practice and do not give legal advice. If a matter needs a solicitor, we will tell you.
Related GDPR guides
- Do you need a Data Protection Officer in Ireland?
- GDPR for small businesses in Ireland
- Data breach: the 72-hour response guide
- Handling a data subject access request
- GDPR and employee data: employer guide
- GDPR consent in Ireland
- GDPR fines and the Data Protection Commission
- Privacy and cookie policies for Irish websites
Other services: Outsourced DPO · GDPR compliance projects · GDPR audit and gap analysis · DPIA support
Request an audit quote
Or call 085 804 1664
Looking for help with your own data rights as an individual? Contact the Data Protection Commission.