Privacy, Data & AI Governance

PDPA Audit & Review

Review privacy controls and operating evidence to identify gaps and prioritise improvements.

Start your enquiry

SERVICE IN DETAIL

From the first assessment to practical outcomes

Who this service is for

Boards, management, internal audit and regulated organisations that need an evidence-based view of controls.

How we work

Scope & audit planning
Privacy audit boundaries, processing inventory and evidence requirements
Confirm the business activities, systems, locations and assessment criteria. Establish the audit period, evidence request list and sampling approach, taking account of the independence required for the engagement.
Evidence-based assessment
Notices, consent records, rights requests, retention and processor oversight
Interview control owners and trace selected transactions or activities to supporting records. Evaluate both control design and operation, validate exceptions with the responsible teams and document the basis for findings.
Reporting & follow-up
Privacy control findings, management actions and correction evidence
Present findings with risk, evidence and practical recommendations. Agree management responses, owners and target dates; review corrective evidence where follow-up is included. Any formal assurance conclusion depends on the applicable criteria and assessment results.

What you receive

Audit plan and evidence request list
Findings report with evidence, risk and recommendations
Management action register and agreed follow-up results

Before we begin

We confirm the scope, responsibilities, evidence, timetable and deliverables in the proposal. The activities above are tailored to the systems and objectives agreed with your organisation.

Discuss your scope

LET’S UNDERSTAND YOUR NEEDS