GDPR audit for small UK organisations

Most small organisations know UK GDPR applies to them, but very few have had anyone check whether what they do matches what they say. A GDPR audit from Unavoidably Secure looks at your documents, your website and the systems that hold personal data, then tells you in plain English where you stand and what to do next.

Who this is for

The audit is built for organisations without an in-house compliance team: dental practices, care providers, clinics, charities, professional firms and other small businesses that hold customer, patient or staff data. It suits you if you have never had an outside review, if you have grown since your policies were written, or if a commissioner, insurer or client has started asking for evidence.

Health and care organisations hold special category data, which UK GDPR treats as higher risk. If you also have NHS work, the Data Security and Protection Toolkit applies too, and our DSPT support covers both in one engagement.

What we check

A paper exercise only tells half the story, so we look at what you have written down and what actually happens.

Area	What we look at
Records and lawful basis	Your record of processing activities, the lawful basis for each use of personal data, and whether special category data has the extra condition it needs.
Privacy information	Whether your privacy notice is accurate, complete and easy to find, and whether it matches what your website and staff really do.
Cookies and consent	What your website sets before a visitor agrees to anything, whether refusing is as easy as accepting, and whether marketing consent meets PECR.
Suppliers and sharing	Contracts with processors such as IT, software and payroll suppliers, and any transfers of data outside the UK.
Retention	How long you keep each kind of record, and whether old data is actually deleted.
Individual rights	How you would handle a subject access request, a correction or an erasure request, and who is responsible.
Security of processing	Email impersonation protection, encryption, access control, multi-factor authentication and backups, assessed from the outside and on evidence your IT provider produces.
Breach readiness	Whether you would spot a breach, who decides if it is reportable, and whether you could report it to the ICO within the 72 hours UK GDPR allows.

What you get

You receive a written report you can hand to a partner, a board or an inspector. It contains a findings register that rates each issue by risk, a mapping of every finding to the relevant part of UK GDPR or PECR, and a prioritised remediation plan that says who should do what. Where a fix is technical, we write it so your IT provider can act on it straight away. We then walk you through the report on a call, and the full audit includes a re-test at 60 days so you can show the gaps are closed.

What it costs

Every engagement is a fixed fee, quoted up front after a short scoping call, so you know the cost before any work starts. The external audit is free. Our full audit, which covers UK GDPR and PECR across all four areas we assess, starts from £950. There is no day rate and no surprise invoice at the end. See all our fees.

How it works

First, a scoping call to understand what data you hold and who touches it. Second, a written authorisation that sets out exactly what we will and will not test. Third, the audit itself: we review your documents, check your website and email from the outside, and work from evidence your IT provider supplies. Fourth, the report and a walkthrough call. Finally, the re-test, so the improvement is on record.

We do not carry out the fixes, give legal advice or act as your Data Protection Officer. Keeping those roles separate is what lets the audit stay independent.

Common questions

This page is general information, accurate at the time of writing (November 2026), and is not legal advice. No assessment certifies compliance with any standard. Fees are fixed and quoted after a scoping call.