GDPR Audit in Ireland: What It Covers and How to Prepare
Last updated 16 October 2026. General information only, not legal advice.
A GDPR audit is a structured check of how your business handles personal data compared with what the GDPR and the Data Protection Act 2018 require. For an Irish owner, manager or compliance lead, it answers a practical question: could we show the Data Protection Commission (DPC) that we comply, and where are the gaps if we could not? This guide explains what an audit covers, what evidence to gather, and how to prepare so the exercise is useful rather than painful.
What is a GDPR audit and is it required?
The GDPR does not use the word “audit” as a general obligation on every business. What it does require is accountability. Under Article 5(2) and Article 24, a controller must be able to demonstrate that its processing complies with the Regulation, and Article 32(1)(d) calls for a process for regularly testing, assessing and evaluating the effectiveness of security measures. An audit is the usual way of doing this in an organised, documented way.
There is also a regulatory reason to be ready. Article 58(1)(b) gives supervisory authorities, including the DPC, the power to carry out investigations in the form of data protection audits, and Article 58(1)(a) lets them require you to supply information. If that happens, the quality of your records matters. You can read more on what is at stake in our guide to GDPR fines and the DPC.
Audit, gap analysis and DPIA: how they differ
These terms are often mixed up. A gap analysis compares what you do now with what the law requires and lists what is missing. An audit usually covers the same ground but also tests whether your documented controls are followed in practice. A data protection impact assessment (DPIA) is different: it is a risk assessment of a specific, new or changing processing activity, required under Article 35 where processing is likely to result in a high risk to individuals. An audit may flag where a DPIA is missing, but it does not replace one.
What a GDPR audit covers
1. Data mapping and records of processing
The starting point is knowing what personal data you hold, where it sits, why you have it and who receives it. Article 30 requires a written record of processing activities. The exemption for organisations with fewer than 250 employees is narrow: it does not apply if the processing is likely to result in a risk to individuals, is not occasional, or includes special-category data or criminal-offence data. Most businesses that process payroll, customer accounts or health information on a regular basis will therefore still need a record.
2. Lawful basis and consent
For each purpose, an auditor checks that you have identified a lawful basis under Article 6 (and an Article 9 condition for special-category data), that it is documented, and that it fits reality. Consent in particular must meet the GDPR standard; see our guide to GDPR consent.
3. Transparency and privacy notices
Articles 13 and 14 require you to tell people how their data is used. The audit compares your privacy notices, website policies and cookie practices with what you actually do.
4. Data subject rights
Do you have a working process to handle access, erasure, rectification, objection and other requests? Under Article 12(3) a response is generally due within one month, which can be extended in certain circumstances. An audit looks for a log, a named owner and evidence of recent requests being handled.
5. Security measures
Article 32 requires appropriate technical and organisational measures. Expect questions on access control, encryption, backups, device management, staff training and supplier security. The audit tests whether these exist and whether they are proportionate to the risk.
6. Breach readiness
Article 33 requires notification to the DPC without undue delay and, where feasible, within 72 hours of becoming aware of a notifiable breach, and Article 33(5) requires you to document all breaches. An audit checks that staff know how to escalate and that a breach register exists. Our 72-hour data breach response guide covers the process.
7. Processors and international transfers
Where a supplier handles personal data for you, Article 28 requires a written contract with specific terms. Where data leaves the EEA, Chapter V (Articles 44 to 49) requires a valid transfer mechanism. The audit lists your suppliers and checks both.
8. Governance, DPO and DPIAs
This section checks whether you must appoint a Data Protection Officer under Article 37, whether one is appointed and properly supported, whether policies are approved and current, whether staff are trained, and whether DPIAs were completed where needed. Our guide on whether you need a DPO in Ireland explains the test.
How to prepare for a GDPR audit
Preparation is what separates a quick, useful audit from a slow one. Before the audit starts, gather the following:
- Your record of processing activities, or a list of the systems and spreadsheets that hold personal data.
- Privacy notices, website privacy and cookie policies, and any staff data protection notice.
- Contracts with suppliers that handle personal data, such as payroll, IT, cloud, marketing and CCTV providers.
- Internal policies: data protection, retention, security, remote working, acceptable use and breach response.
- Your breach register, data subject request log and any DPIAs.
- Training records showing who was trained and when.
- Names of the people who own each area, so the reviewer can speak to the right person.
Then decide the scope. A whole-organisation audit suits a business that has never had a review. A targeted audit, for example of HR data, marketing or a single system, suits a business that already has a baseline.
What the results should look like
A useful audit report lists each finding, links it to the relevant GDPR article, rates the risk and recommends an action with an owner. It should separate quick fixes (an out-of-date privacy notice) from larger projects (rebuilding a retention schedule). Treat it as a living action plan, and repeat the review when your systems, suppliers or activities change. No audit can promise “full compliance”: it reports a position at a point in time, and compliance depends on what you do next. For a wider overview see our GDPR guide for small businesses or the GDPR and data protection hub.
Common findings in Irish businesses
Typical gaps include no up-to-date record of processing, privacy notices that do not match practice, missing processor contracts, no retention schedule so data is kept indefinitely, no tested breach procedure, and no evidence of staff training. These are generally fixable once identified, and fixing them also reduces the risk of a breach in the first place.
Need help with this?
Need help with this? Plus Promotions Limited provides GDPR audit and gap analysis for Irish businesses, from €495.
Frequently asked questions
What is a GDPR audit?
A GDPR audit is a structured review of how your organisation collects, uses, stores, shares and deletes personal data, measured against the GDPR and the Data Protection Act 2018. It produces findings and a prioritised action list. It is not a certification or a guarantee of compliance.
Is a GDPR audit mandatory in Ireland?
The GDPR does not require a named “audit” for every business. It does require controllers to implement appropriate measures and be able to demonstrate compliance (Article 24), and to regularly test and evaluate the effectiveness of security measures (Article 32(1)(d)). An internal or external audit is a common way to do both.
What is the difference between a GDPR audit and a gap analysis?
The terms overlap. A gap analysis usually compares your current practice to the GDPR’s requirements and lists what is missing. An audit may go further and test whether documented controls are actually followed in practice, for example by sampling records and checking access rights.
How long does a GDPR audit take?
It depends on the size of the organisation, the number of systems and the quality of existing documentation, so no single timeframe applies. Having your records, contracts and policies ready in advance shortens the work.
How often should a business review its GDPR compliance?
The GDPR does not set a fixed interval. A sensible approach is to review at least annually and whenever something significant changes, such as a new system, a new supplier, a new type of data or a data breach.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
