Compliance & Regulation
GDPR Compliance Checklist: What Organizations Must Have in Place
GDPR is not new, but compliance gaps persist. A practical checklist of what controllers and processors must have in place — and be able to evidence.
Key takeaways
- Agree scope, criteria and timetable with the auditor early.
- Maintain an evidence library mapped to controls throughout the year.
- IT general controls — access, change, operations — attract the most findings.
- Respond to findings with root cause, owner and realistic dates.
Know the type of audit
- Internal audit — independent assurance for management and the audit committee.
- External financial audit — auditors rely on IT general controls supporting financial systems.
- Certification audit — ISO 27001, ISO 22301, ISO 20000 and similar.
- Regulatory review — sector regulators and supervisory authorities assessing compliance.
- Customer audit — contractual rights to assess you as a supplier.
IT general controls auditors test
| Area | Typical tests |
|---|---|
| Access management | Joiner/mover/leaver timeliness, privileged access, periodic reviews |
| Change management | Approval, testing, segregation of duties, emergency changes |
| IT operations | Backups, job monitoring, incident management |
| Security | Logging, vulnerability management, endpoint protection |
| Third parties | Supplier assurance, contracts, access |
The evidence library
Keep a structured repository where each control has its policy, procedure, owner and dated evidence. Samples auditors commonly request include user listings with review sign-offs, change tickets with approvals, backup logs with restore tests and incident records.
Pre-audit checklist
- Confirm scope, criteria, period under review and sampling approach.
- Nominate an audit coordinator and control owners.
- Run a self-assessment against the criteria.
- Close quick wins and document compensating controls.
- Prepare system walkthroughs and data extracts.
- Brief control owners on how to answer questions factually.
Most common findings
- Leavers with active accounts beyond the agreed SLA
- Access reviews performed but not evidenced, or not acted upon
- Emergency changes without retrospective approval
- Backup restores never tested
- Policies out of date or not approved
Responding to findings
Agree the facts, identify root cause, assign an owner and set realistic dates. Track actions in a single register and report progress to the audit committee. Repeat findings damage credibility more than the original issue.
Building a year-round evidence calendar
| Month | Evidence activity |
|---|---|
| Monthly | Leaver reconciliation, backup reports, vulnerability metrics |
| Quarterly | Access reviews, policy exceptions, supplier reviews |
| Semi-annually | Restore tests, incident exercises |
| Annually | Policy reviews, risk assessment, DR test |
Next step: our Audit & Assessment team runs pre-audit readiness reviews and regulator-ready assessments.
Frequently asked questions
How early should we start preparing?
Ideally evidence is maintained continuously. For a specific audit, start structured preparation six to eight weeks ahead.
Can we challenge an audit finding?
Yes, with evidence. Discuss draft findings factually before the final report is issued.
What is the difference between a gap assessment and an audit?
A gap assessment is advisory and identifies improvements; an audit provides independent assurance against defined criteria.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
