Home / Services / GDPR Examinations
GDPR Compliance Examinations
Independent GDPR Examinations for Organizations That Handle EU Personal Data
Linford & Company LLP examines your compliance with selected requirements of the EU General Data Protection Regulation and issues an independent report under AICPA AT-C Section 315.
Examination scope
Choose the requirements in scope
Select the GDPR requirements that apply to your organization. We confirm the final scope with you in the engagement letter.
The report
One examination, one report
Every GDPR examination is performed and reported under AICPA AT-C Section 315, Compliance Attestation.
Our examination process
A clear, phased approach from start to finish
Designed to keep your effort low, with a high level of partner involvement throughout.
Plan
We agree the GDPR requirements in scope, then provide a fee estimate, a timeline, and a request list.
Understand
We learn your processing activities, systems, data flows, policies, and the people responsible.
Examine
Interviews, inspection of records, and testing, onsite or virtual, planned to keep disruption low.
Report
A professional GDPR compliance report, delivered digitally, issued under AT-C Section 315.
What your report is
Clear insight. Real value.
An independent examination of your compliance with the GDPR requirements you select, performed by a licensed CPA firm.
- Coverage of the GDPR requirements you select
- Testing of your policies, procedures, and records
- An independent opinion from a licensed CPA firm
- Issued under AICPA AT-C Section 315
What it is not
Our report is not:
- A legal determination of GDPR compliance
- A certification under GDPR Article 42
- Help designing or running your privacy program
Our partners
Experienced. Independent. Impartial.
Partners who stay involved in your examination. Meet all 20 partners
- Nicole Hemmer
Partner
CISSP, CISA
Leads our GDPR examinations. Co-founder of Linford & Company LLP who specializes in SOC examinations, after beginning her career at Ernst & Young.
Frequently asked questions
GDPR examination questions
Answers to common questions about our GDPR examinations.
What does a typical GDPR examination include?
We test your compliance with the GDPR requirements in scope, such as the lawful basis for processing, data subject rights, security of processing, and breach notification. The work includes interviews, inspection of policies and records, and testing of how those requirements are met in practice.
What standard is the report issued under?
GDPR compliance reports are issued under the attestation standards of the American Institute of Certified Public Accountants (AICPA), AT-C Section 315, Compliance Attestation.
Does the report provide a legal determination of compliance?
No. A report issued under AT-C Section 315 does not provide a legal determination of an entity's compliance with specified requirements. It may, however, be useful to legal counsel or others in making that determination.
Is a GDPR examination the same as GDPR certification?
No. Certification under GDPR Article 42 is issued by certification bodies accredited under an approved certification scheme. Our report is an independent CPA examination of the requirements in scope, not an Article 42 certificate.
Who can use the report?
The report can be shared with customers, prospective customers, and business partners who want independent evidence of how you protect personal data, or its use can be limited to management. Who may use the report is agreed in the engagement letter before work begins.
How is the scope determined?
Management selects the GDPR requirements in scope based on the organization's processing activities. We confirm the scope, the period, and who may use the report in the engagement letter before work begins.
How is this different from ISO/IEC 27701?
ISO/IEC 27701 certifies a privacy information management system against an international standard. A GDPR examination reports on your compliance with specific GDPR requirements. Linford & Company LLP performs both, and is an ANAB-accredited certification body for ISO/IEC 27701.
What affects the fee?
The requirements in scope, the number and complexity of your processing activities, the systems and locations involved, and the size of your organization. We provide a specific quote and timeline before the examination begins.
A higher standard
Talk to a partner, not a sales team.
Work with experienced auditors who understand privacy.