---
title: Run a GDPR / HRIS compliance audit
description: "GDPR, Swiss nFADP, retention periods, employee rights, sub-processing: an HR compliance audit spots gaps before a regulator (CNIL, PFPDT) or an employee complaint does it for you. - **Reading time**5 min - **Level**Advanced - **Last updated**May 2026 - **Module**HR audit…"
url: "https://illizeo.com/en/centre-aide/run-a-gdpr-hris-compliance-audit/"
updated: "2026-09-21"
category: Consulting
---

# Run a GDPR / HRIS compliance audit

GDPR, Swiss nFADP, retention periods, employee rights, sub-processing: an HR compliance audit spots gaps before a regulator (CNIL, PFPDT) or an employee complaint does it for you.

- **Reading time**5 min
- **Level**Advanced
- **Last updated**May 2026
- **Module**HR audit

## Standard scope

| Section | Content |
| --- | --- |
| Data mapping | What data, where, for how long |
| Legal bases | Contract, legal obligation, legitimate interest, consent |
| Sub-processing | DPA contracts, EU/CH transfers, compliance |
| Employee rights | Access, rectification, erasure, portability procedures |
| Security | Encryption, access control, traceability, incident response plan |
| Documentation | Records of processing, DPIAs, IT charter |

## Step-by-step

1. ### Scoping workshop

   Scope, team, calendar. Half-day with HRD, CIO, DPO.
2. ### Document collection

   Privacy policy, processing register, vendor contracts, evidence of technical measures. 1 week.
3. ### Interviews and tests

   Verify that practice matches documentation. Access tests, exfiltration tests, user rights checks.
4. ### Gap report

   List of gaps by severity (blocking, major, minor), priced and prioritised recommendations.
5. ### Remediation plan

   Quick wins (30 days), structural projects (3-6 months), governance (DPO, CISO, committees).

## FAQ

   How much does a compliance audit cost?

Flat fee per size (50, 200, 500, 1,000+). Quote on the Premium Consulting page.

   Must we involve the in-house DPO?

Yes, essential. The DPO is our main contact and co-builds the report.

   And DPIA?

If you process sensitive data at scale (health, surveillance), a DPIA is mandatory. We support its drafting.

   In case of regulator audit?

The audit is significant proof of good faith if regulators come knocking. They value preventive efforts.

### See Process & tooling diagnosis

Learn how to measure HR digital maturity.

[See all Consulting articles](/en/centre-aide/?cat=consulting)

### *Related*