A GDPR review becomes more useful when it follows a real activity through the business. The privacy notice may describe retention, rights and suppliers clearly, while the people carrying out those tasks still have unanswered questions.
The ICO's data protection audit framework provides a structured reference for examining organisational arrangements. The scenarios below are a practical way to begin that discussion, rather than a complete legal compliance test. ICO audit framework.
Ask where the request would arrive and who would recognise it. Identify the systems likely to hold relevant information, including support tickets and supplier platforms. Check how the team verifies identity, coordinates the response and records decisions.
Do not use a colleague's real personal data for an informal exercise. A fictional request can reveal unclear ownership without creating another data-handling problem.
Follow the account through production systems, exports, support records and third parties. Which records can be deleted, which must be retained for a justified reason, and how is that distinction communicated?
A retention table is only useful when the relevant systems and owners can apply it. Where backups or legal retention affect the process, the explanation needs to match the actual arrangement.
Ask what information will be sent, why it is needed and what the supplier can do with it. Record who assesses the proposed processing, contractual terms, access, retention and transfer implications. Decide whether a more detailed impact assessment is needed before deployment.
The exercise should produce a decision and owner, rather than an unanswered questionnaire saved in a folder.
Use a short register: scenario, expected process, observed gap, affected data, owner and next action. Distinguish a missing explanation from a process that cannot currently be performed.
For example, "update the privacy policy" may be the wrong first action if no one knows which supplier stores the records. Establish the facts, fix the process and then update the wording.
A business with unclear data flows may need discovery and a gap assessment. A business with known gaps may need implementation capacity. A business introducing frequent changes may benefit from continuing advice.
ProtectifyAI offers GDPR consultancy and implementation for UK and European organisations. If the change involves AI, connect the privacy work with EU AI Act readiness rather than treating them as unrelated projects.
It means turning GDPR obligations into owned, repeatable workflows for data inventory, rights requests, retention, incidents, suppliers, transfers and evidence.
Yes, security controls can support GDPR readiness, but they do not replace lawful-basis, transparency, rights, retention or transfer analysis.
A focused review commonly takes two to four weeks; implementation often takes six to twelve weeks depending on data sources, suppliers and existing evidence.
Bring one of these scenarios to a working session and we'll help you trace it through your business.
Book a working session →