ISO/IEC 27701:2025 & GDPR Privacy Audit

Stage 1: Audit Readiness Review

Stage 1 is conducted to determine whether the organization is ready for a detailed Stage 2 audit evaluation against ISO/IEC 27701:2025 and applicable GDPR criteria. This stage reviews the defined PIMS scope, organizational context, privacy governance structure, documented information, key processing activities, and availability of evidence required to support the audit.

• Scope and Boundaries Review: Review of the defined PIMS scope, including organizational units, services, locations, systems, processing activities, and controller or processor responsibilities included in the audit scope.
• Organizational Context Review: Evaluation of internal and external issues, interested parties, privacy obligations, regulatory requirements, and interfaces relevant to the Privacy Information Management System.
• Documented Information Review: Review of key documented information supporting the PIMS, including policies, procedures, records, registers, privacy notices, roles, responsibilities, and governance documents.
• Processing Activity and Data Flow Review: Review of personal data processing activities, data categories, purposes, lawful bases, transfers, retention requirements, and key data flows within the defined scope.
• Privacy Risk and Control Review: Review of the organization’s approach to privacy risk assessment, risk treatment, control selection, and monitoring of technical and organizational measures.
• Internal Audit and Management Review Check: Verification that internal audit, management review, corrective action, and continual improvement processes are established and provide input for audit readiness.
• Stage 2 Audit Planning: Confirmation of audit locations, functions, interviewees, evidence requirements, sampling approach, and areas requiring detailed verification during Stage 2.

Deliverable: A Stage 1 Audit Readiness Report documenting the reviewed scope, audit criteria, readiness status, identified concerns, and areas to be verified during Stage 2.

Stage 2: Audit Evaluation

Stage 2 evaluates the implementation, operation, and maintenance of the organization’s privacy controls, governance arrangements, documented procedures, and operational practices against the selected ISO/IEC 27701:2025 and GDPR audit criteria. The evaluation is based on objective evidence obtained through document review, interviews, sampling, and verification of implemented practices.

• Privacy Governance Assessment: Evaluation of governance structure, accountability, reporting lines, management oversight, and responsibility for personal data protection.
• PIMS Documentation Review: Review of documented policies, procedures, records, registers, notices, and other information required to support the Privacy Information Management System.
• Personal Data Lifecycle Assessment: Evaluation of how personal data is collected, processed, stored, shared, transferred, retained, and disposed of.
• Lawful Basis and Transparency Review: Assessment of documented lawful bases, processing purposes, transparency notices, consent records where applicable, and related supporting evidence.
• Data Subject Rights Assessment: Evaluation of procedures and records supporting access, rectification, erasure, restriction, objection, and portability requests.
• Processor and Third-Party Review: Assessment of processor oversight, data processing agreements, data sharing arrangements, international transfer mechanisms, and supplier governance records.
• Technical and Organizational Measures Review: Evaluation of selected controls designed to protect personal data and support confidentiality, integrity, availability, resilience, and accountability.
• Breach and Incident Handling Review: Assessment of personal data breach procedures, escalation processes, notification records, incident response evidence, and regulatory communication where applicable.
• Monitoring and Improvement Review: Evaluation of control monitoring, internal audit results, management review outputs, corrective actions, and continual improvement activities related to the PIMS.

The audit typically covers the following domains:

• Privacy governance and accountability
• Privacy Information Management System documentation
• Records of processing activities and data inventory
• Lawful basis, purpose limitation, and transparency
• Data subject rights management
• Retention and personal data lifecycle controls
• Processor, supplier, and third-party oversight
• International data transfer controls where applicable
• Privacy risk management and control monitoring
• Technical and organizational data protection measures
• Personal data breach handling and notification processes
• Internal audit, management review, and corrective action processes
• Alignment with applicable ISO/IEC 27701:2025 and GDPR audit criteria

Deliverable: Stage 2 audit evaluation results, including:

• Assessment of conformity with applicable ISO/IEC 27701:2025 and GDPR criteria
• Identification of nonconformities, observations, and evidence gaps where applicable
• Evaluation of the implementation and maintenance of privacy governance and PIMS controls
• Summary of audit evidence reviewed, interviews conducted, and samples assessed
• Documented audit findings based on objective evidence

Stage 3: Audit Reporting

Stage 3 consolidates the audit results into a formal audit report. The report presents the audit scope, criteria, methodology, evidence reviewed, findings, and audit conclusion. Where nonconformities or observations are identified, they are documented against the applicable requirement or agreed audit criterion.

• Audit Finding Classification: Classification of findings based on objective evidence, including conformity, nonconformity, and observations where applicable.
• Requirement Mapping: Mapping of findings to relevant ISO/IEC 27701:2025 requirements, GDPR obligations, internal requirements, contractual requirements, or other agreed audit criteria.
• Evidence Summary: Documentation of reviewed records, interviewed roles, sampled processes, verified controls, and scope limitations where applicable.
• Nonconformity Description: Clear description of any identified nonconformity, including the applicable requirement, objective evidence, and affected process or control area.
• Audit Conclusion: Independent conclusion on the level of conformity with the defined audit criteria within the agreed audit scope.
• Closing Meeting: Presentation of audit results to relevant management representatives, including key findings, identified nonconformities, observations, and audit conclusions.

Deliverable: A formal Privacy Audit Report documenting the audit scope, criteria, methodology, evidence reviewed, findings, nonconformities where applicable, and the overall audit conclusion.

Basis of Work

The audit is performed against agreed privacy, information security, regulatory, and organizational criteria to ensure a consistent, impartial, and evidence-based audit approach.

• ISO/IEC 27701:2025: Privacy Information Management System requirements and guidance.
• Regulation (EU) 2016/679: General Data Protection Regulation.
• ISO/IEC 27001:2022: Information Security Management Systems — Requirements.
• ISO/IEC 27002:2022: Information security, cybersecurity and privacy protection controls.
• Applicable Internal Policies and Procedures: Organizational governance documents, privacy procedures, records, and supporting control framework documentation.
• Contractual and Regulatory Requirements: Applicable privacy, data protection, processor, controller, customer, and regulatory requirements included in the agreed audit scope.

The audit report reflects the results of evidence reviewed during the engagement and is limited to the defined audit scope, agreed criteria, audit sampling, and information made available at the time of the audit.

This engagement does not include consulting, implementation, control design, policy drafting, legal advice, or certification issuance. The audit results are intended to provide an independent assessment of conformity and audit readiness against the agreed criteria.