How does a GDPR audit work and what does it really cost?
·
By 
Aymeric Guyard · 5 min read
Is a GDPR audit mandatory?
The GDPR does not impose an 'audit' as such. It imposes better: the principle of accountability (Article 5, paragraph 2, and Article 24), which requires the controller to be compliant and to be able to demonstrate it at any time. The audit is the means of producing this demonstration: a dated state of play, identified gaps, monitored action plan. It is also the first document that the French data protection authority (CNIL) examines during an inspection, and the one increasingly requested by customers, cyber insurers and investors in due diligence.
The six-phase method
- Scoping (2 to 3 days): legal scope (entities, countries), business scope (priority processes: HR, marketing, sales, support, IT), contacts, timeline, assessment framework (GDPR articles, the French data protection authority (CNIL) frameworks and guides, including the personal data security guide).
- Collection (1 week): interviews with business units, document review (policies, contracts, privacy notices, existing record, DPIAs, breach and rights procedures), technical review (access control, logging, backups, encryption, processors and transfers).
- Processing mapping: purpose-by-purpose inventory, with for each one legal basis, categories of data and data subjects, retention periods, recipients, transfers, security measures. This phase initialises or updates the Article 30 record (see our record guide and its 12 errors).
- Gap analysis: each requirement is rated (compliant, partially compliant, non-compliant, not applicable), with supporting evidence. The families examined: lawfulness and legal bases, information to data subjects, exercise of rights, retention periods, processors and transfers, security, breaches, governance and documentation.
- Risk-based prioritisation: cross-referencing severity for individuals × probability × legal exposure. Lack of information on a showcase website and a prospecting database without legal basis do not call for the same urgency.
- Action plan and presentation: dated actions with owner, effort and quick wins within 30 days, presented to management. Without this presentation at the right level, the audit ends up in a drawer.
The three deliverables to require
- The audit report: executive summary (overall score, major risks), detailed gaps with article references, evidence examined.
- The record of processing activities initialised in a maintainable tool, not a frozen Excel spreadsheet.
- The prioritised action plan with milestones, effort and owners, directly manageable.
Beware of audits that deliver an 80-page PDF report without a record or actionable plan: you are paying for a statement, not a roadmap.
How much does a GDPR audit cost?
The price depends on three factors: the size of the scope (number of processes and entities), the sensitivity of the data (health, minors, biometric data) and the expected technical depth. Typical ranges observed in the French market:
| Option | Typical range | For whom |
|---|---|---|
| Consultancy or law firm, bespoke audit | From a few thousand to several tens of thousands of euros depending on scope, billed per day | Large enterprises, contentious situations, heavily regulated sectors |
| Compliance platform with tool‑based diagnostic and expert support | A fraction of consultancy cost, as a monthly subscription including tooling and ongoing monitoring | SMEs, mid‑caps, local authorities, SME groups |
| Online self‑assessment | Free | Initial snapshot in 15 minutes, before committing a budget |
The real comparison is not on the audit price but on the cost of the compliance journey: a one‑off audit becomes outdated within a few months if nothing supports ongoing monitoring, whereas compliance is a continuous obligation. This is precisely why coupling the diagnostic with the platform that will carry the action plan, the record of processing activities and the evidence makes sense.
In‑house, external or tool‑based: who should conduct the audit?
- In‑house self‑audit is possible and useful on a routine basis, provided you have a framework and an independent view of operations; its classic blind spot is involuntary complacency.
- External audit brings independence and control experience; it is recommended for the initial assessment, after an incident, before fundraising or certification.
- The tool‑based model combines both: a structured diagnostic by the platform, reviewed by an expert (outsourced DPO), then automated periodic reviews. It offers the best rigour‑to‑cost ratio for an SME or mid‑cap.
Take action
Manage your compliance with Data Comply One: all-in-one software and outsourced DPO/CISO experts.
Discover the outsourced DPO →Test my GDPR compliance →Sources
- Regulation (EU) 2016/679 (GDPR), Articles 5, 24, 28, 30, 32, 33, 34 and 35, EUR-Lex.
- The French data protection authority (CNIL), guide to the security of personal data (2024 edition) and sector frameworks.
- The French data protection authority (CNIL), 'CNIL controls': procedure and powers of the authority.