GDPR evidence dossier
How can you compile a traceable GDPR audit file without confusing a generated summary, documentary evidence and a legal conclusion?
1960 € per session, excl. VAT
In short
A 7-hour day, excluding breaks, to scope an audit, organise evidence and prepare interviews with support from generative AI. Participants build a control matrix, verify the proposed findings and prioritise the additional material needed, without delegating legal judgement to the tool.
Why this training?
A large dossier does not necessarily constitute usable evidence: conflicting versions, documents without owners and oral responses undermine preparation. The challenge is to link each control to identifiable elements. Generative AI can help compare documents and prepare questions, but it can also invent a reference or read too much into missing information. The method systematically distinguishes between documented facts, hypotheses and points requiring validation. Continuing case study: The fictitious organisation Brévolis Archivage is preparing an internal audit of its HR and commercial processing activities. Its dossier includes an incomplete record of processing activities, conflicting privacy notices and scattered service provider contracts. Participants must make these elements auditable and clearly identify the missing documents. Transfer to the workplace: Reuse the matrix within an authorised business scope, assign evidence owners and organise a review with the DPO or legal department. Measure documentary coverage before and after collection, without treating it as a compliance rate.
Objectives of this training
- Define the processing activities and contacts within the audit scope
- Structure a matrix linking controls, sources and evidence
- Compare documents using verifiable AI instructions
- Assess documentary gaps without automatically concluding that they constitute non-compliance
- Prioritise follow-up requests and measure the quality of the dossier
Who is it for and what are the prerequisites?
Roles and tasks concerned
- DPOs, data protection contacts and compliance managers
- Internal auditors and business managers responsible for gathering evidence
Prior skills
- Understand the concepts of processing, records of processing activities, controller and processor.
- Use a generative AI assistant and know how to formulate a structured request.
- Participate in a compliance initiative or documentary audit.
What you will work on
Define the scope
Objective: Define the boundaries of the documentary audit. Relevant processing activities, stakeholders, exclusions and confidentiality rules for exchanges with AI.
Build the controls
Objective: Link each audit question to a verifiable basis. Records of processing activities, information provision, rights, retention, security and processing by processors; official GDPR references and CNIL resources to consult.
Index the evidence
Objective: Make documents retrievable and comparable. Document identifiers, versions, owners, scopes covered and restrictions on sharing.
Verify the proposed discrepancies
Objective: Distinguish between contradictions, absence of evidence and hypotheses. Instructions limiting the analysis to the document set; verification of quotations and connections drawn.
Prepare the interviews
Objective: Turn uncertainties into precise requests. Open questions, relevant contacts, expected evidence and traceability of responses.
Assess the dossier
Objective: Prioritise additional material and organise validation. Documentary coverage, substantiated findings, blocking issues and limitations of the assessment.
What you take away
- Scoping note and document inventory
- Control matrix with evidence index
- Interview guide and register of verified findings
- Prioritised collection plan and quality table
Method and assessment
- Short instructional sessions followed by immediate practice on the continuing case study.
- Individual work followed by work in pairs, with peer review of the outputs.
- Guided group discussion: what works, what needs correcting and what remains a human decision.
- Preparation: Identify an audit scope and the categories of documents usually available, without sharing real data. Check which tools the organisation authorises; the exercises use only fictitious or anonymised documents.
Observable criteria: Each control has an identifiable source or an explicit verification status. ; Each finding refers to a document and passage, or identifies missing evidence. ; Unsubstantiated AI suggestions are removed or flagged as hypotheses. ; Each follow-up request includes an owner, a priority and a proposed deadline. ; Documentary coverage is calculated with an explicitly stated numerator and denominator..
Frequently asked questions
Can AI conclude that compliance has been achieved?
No. It supports the analysis; conclusions are the responsibility of a qualified professional, with no automated sensitive decisions.
Can we use our real dossiers?
The exercises remain fictitious or anonymised and use only tools authorised by the organisation.
Does a missing document prove a breach?
No. Its absence triggers a follow-up request and a human assessment.
Is this a full audit?
No. The day prepares the documentary dossier; technical investigations and final conclusions remain separate.
Last updated: