COMPLIANCE

Annual GDPR Compliance Audit

Comprehensive yearly review of the GDPR compliance posture. Updates the RoPA, reviews consents and retention, checks processors, and refreshes DPIAs, policies, and training.

Tasks
25
Span
62d
Use this template in Dorift Download for Android Download as JSON

Tasks in this template

  1. 1
    Update the records of processing activities (RoPA) D+3

    Article 30: controllers and processors maintain records of processing activities; these are the primary evidence of accountability (Art. 5(2)).

  2. 2
    Inventory all processing activities added or changed during the year D+5
  3. 3
    Review consent records and renew expired consents D+8

    Article 7: consent must be freely given, specific, informed, unambiguous, and demonstrable. Consents without a clear basis must be refreshed.

  4. 4
    Audit data retention against the retention schedule D+10
  5. 5
    Delete or anonymise data beyond its retention period D+13

    Article 5(1)(e) storage limitation: data kept no longer than necessary. Document deletion with proof (log, certificate, attested procedure).

  6. 6
    Review all processor contracts for Article 28 compliance D+15

    Article 28(3): the DPA must include subject matter, duration, nature and purpose, type of personal data, categories of data subjects, and the controller's obligations and rights.

  7. 7
    Update the list of processors and sub-processors D+18
  8. 8
    Verify standard contractual clauses (SCCs) or adequacy for international transfers D+20
  9. 9
    Review international transfer impact assessments (TIAs) D+22

    Chapter V & Schrems II: transfers outside the EEA require a transfer tool (adequacy decision, SCCs, BCRs) plus supplementary measures where needed.

  10. 10
    Review privacy notices for accuracy and completeness D+25
  11. 11
    Review internal policies: retention, breach response, DSAR, marketing D+28
  12. 12
    Refresh DPIAs for changed or new high-risk processing D+30

    Article 35(11): the controller carries out a review to assess whether processing is performed in accordance with the DPIA at least when there is a change of risk.

  13. 13
    Review training records and plan the annual training cycle D+33
  14. 14
    Audit the breach register and review incident trends D+35
  15. 15
    Review cookie consent and tracking technology stack D+38

    ePrivacy Directive + GDPR: non-essential cookies require prior consent. Reject-all must be as easy as accept-all.

  16. 16
    Verify the cookie banner and preference center are functioning D+40
  17. 17
    Audit DSAR handling performance and SLAs D+43
  18. 18
    Review and test the data breach response procedure D+45

    Run a tabletop exercise simulating the 72-hour Article 33 notification window.

  19. 19
    Review the DPO's position, independence, and resources D+48
  20. 20
    Assess DPO workload and reporting line to management D+50
  21. 21
    Review access control matrix and quarterly access reviews D+53
  22. 22
    Audit logging and monitoring coverage D+55
  23. 23
    Review encryption, pseudonymisation, and key management D+58
  24. 24
    Prepare the annual DPO report to management D+60
  25. 25
    Archive all audit evidence and plan remediation tracking D+62
← Back to Dorift