Made in IrelandPlain EnglishPassport anyone can verify
Self-audit compliance · Made in Ireland
Make compliance defensible for clubs.charities.small businesses.boards.
Pick an audit written for organisations like yours, answer it in plain English and fix every gap with clear steps — then prove it with a passport anyone can check.
Answer an audit in plain English, fix every gap — and get a passport anyone can check.
NIS2, ISO 27001 and DORA usually reach you through a customer’s contract. Get ready once, keep the evidence in one place, and answer the next questionnaire in minutes.
NIS2, ISO 27001 and DORA — get ready once and keep the evidence in one place.
Short courses from the AuditGlass expert panel, with a verifiable certificate at the end — and every course you finish counts as evidence in your audit.
Short courses from panel experts, with a certificate — and they count as audit evidence.
GDPRCharities Governance CodeGovernance Code for SportNIS2ISO/IEC 27001DORAEU AI ActCyber basicsEuropean Accessibility ActePrivacy
02Who it’s for
Written for the way you are run.
A tennis club, a food bank and a logistics firm don’t share the same risks, people or paperwork. Each audit is written for one of them — and says who inside should answer every question.
A tidy CCTV policy can still have five gaps. Move the lens across this one to see what a data protection case officer, a funder or a customer’s security team would pick up. On a phone, the lens drifts by itself.
St Brigid’s National School
CCTV policy
Ratified by the board of management
Purpose
CCTV is installed to protect the safety of pupils, staff and visitors, and to protect school property from vandalism.
Purposes statedSpecific and legitimate. Security of people and property is the usual basis.
Where cameras are
Cameras cover the main entrance, the yard, the corridors and the staff room.
Knock-out: staff room cameraFilming a rest area is hard to justify as proportionate. Remove it, or prove the need in a DPIA — Art. 35.
Signs
A sign stating that CCTV is in operation is displayed at the main gate.
One sign isn’t enoughSigns are needed at each monitored area, naming the school, the purpose and a contact — DPC CCTV guidance.
Using the footage
Footage may be reviewed by the principal to investigate incidents, including staff conduct and pupil behaviour.
Staff monitoring not declaredChecking staff conduct is a new purpose. Staff must be told in advance — Art. 5(1)(b), Art. 13.
How long we keep it
Recordings stay on the recorder in the office until the disk is full and old footage is overwritten.
No fixed periodThe DPC says keeping footage longer than a month is hard to justify, unless an incident is under investigation.
Parents’ requests
Parents may view footage of an incident involving their child at the school office.
Knock-out: other pupils shownA parent can see their own child. Other children must be blurred, or the request handled another way — Art. 15(4).
What an auditor sees
6 checks · 5 gaps · 2 knock-outs
School data protection · CCTV
Purpose
CCTV is installed to protect the safety of pupils, staff and visitors, and to protect school property from vandalism.
Purposes statedSpecific and legitimate. Security of people and property is the usual basis.
Where cameras are
Cameras cover the main entrance, the yard, the corridors and the staff room.
Knock-out: staff room cameraFilming a rest area is hard to justify as proportionate. Remove it, or prove the need in a DPIA — Art. 35.
Signs
A sign stating that CCTV is in operation is displayed at the main gate.
One sign isn’t enoughSigns are needed at each monitored area, naming the school, the purpose and a contact — DPC CCTV guidance.
Using the footage
Footage may be reviewed by the principal to investigate incidents, including staff conduct and pupil behaviour.
Staff monitoring not declaredChecking staff conduct is a new purpose. Staff must be told in advance — Art. 5(1)(b), Art. 13.
How long we keep it
Recordings stay on the recorder in the office until the disk is full and old footage is overwritten.
No fixed periodThe DPC says keeping footage longer than a month is hard to justify, unless an incident is under investigation.
Parents’ requests
Parents may view footage of an incident involving their child at the school office.
Knock-out: other pupils shownA parent can see their own child. Other children must be blurred, or the request handled another way — Art. 15(4).
Every one of those gaps is a question in our School data protection audit — with the fix, a template and an expert on standby.
St Brigid’s National School · 3 of 8
04How it works
From unsure to proven in five steps.
Website compliance25 min · 28 questions
01
Choose
Pick the audit that fits your organisation — or answer six questions in the finder and we’ll pick for you.
72%
Moderate risk
Is multi-factor authentication switched on for email?
YesPartlyNo
02
Answer
One stage at a time, in plain English. Your score moves with every answer and saves as you go, so nothing is lost if you stop.
Action plan · 3 of 5 done
Publish a club privacy noticeQuick
Turn on MFA for the club emailQuick
Set a retention periodHalf day
03
Fix
Every gap becomes an action with steps, a template and an owner — quick wins first. Stuck? Ask an expert from inside the question.
Expert-verified passport
Ballymore Tennis Club
Club GDPR · 87% · Minor gaps
AG-7K2F-9QX4
04
Prove
Reach the pass mark and get a passport with a public verify page. Need more weight for a tender or funder? Have an expert verify it.
Passport expires in 30 daysRe-verify from last year’s answers — about 10 minutes.
Quarterly pulse check4 quick questions
05
Stay compliant
Reminders at 60, 30 and 7 days, quarterly pulse checks, and next year’s audit starts from this year’s answers.
05Try it now
Three real questions. One honest score.
Straight from our free GDPR essentials audit, weighted exactly as they are in the real thing. Nothing is saved.
0%
Not started
Answer a question to see your score.
A knock-out answer caps your score at 59%, whatever else you answer.
Data protection, cyber security, governance, AI and supplier assurance — each one a guided workflow with a live score, an action plan and a passport at the end.
Every question has a “Get help” button. Choose the kind of help you need at a fixed price, and an expert from the AuditGlass panel picks it up. The answer stays with the question it belongs to.
A written answer from a panel expert to one specific question.
Best forOne question you’re not sure how to answer.
3 days
Expert session (45 min)
€150
A 45-minute video call to work through your gaps with an expert.
Best forTalking a gap through and agreeing the fix together.
5 days
Expert verification
€295
An expert reviews your answers and evidence and issues a verified passport.
Best forTenders, funders and customers who want more than a self-assessment.
5 days
Done for you
€350
An expert drafts the policy, notice or register for you.
Best forA policy, notice or procedure drafted for you to adopt.
10 days
Full audit
from€2,500
A full on-site or remote audit led by an AuditGlass auditor. Priced from €2,500.
Best forBoards and regulated firms that want the AuditGlass team to run it.
Approved before their first request
The panel
Real people with the credentials to back it up.
Data protection officers, security leads and governance specialists, each approved by AuditGlass before they take a request. Turn a card over to see what they help with.
Charities Governance CodeGovernance Code for Sport
Helps with
governance
board effectiveness
risk registers
session
Chartered Governance Professional (CGI)
Not taking new bookings right now
08The passport
Proof anyone can check.
When you reach the pass mark you get a passport: your organisation, the audit, your grade and when it expires, with a code anyone can look up on auditglass.com.
Self-assessed
Issued the moment your own answers reach the pass mark. Shows you’ve worked through a recognised framework and fixed the gaps.
Expert-verified
Issued only after a panel expert has reviewed your answers and evidence. The verify page says so, in green.
Self-assessed passport
Kildare Community Food Hub
Charities Governance Code · Charities Regulator
Grade
Minor gaps
Score
86%
Valid until
27 Oct 2027
Valid
Example · self-assessed
Expert-verified passport
Ballymore Tennis Club
Club GDPR · GDPR
Grade
Minor gaps
Score
87%
Valid until
6 Jan 2027
AG-7K2F-9QX4 Valid
Example · expert-verified
09Staying compliant
Compliance isn’t a one-off.
A passport lasts up to twelve months. AuditGlass keeps an eye on it in between, so nothing lapses quietly and next year takes minutes, not an evening.
Day 0
Passport issued
Shareable verify page goes live.
Every 3 months
Pulse check
A handful of questions on what may have changed.
60 days before
First reminder
Time to plan, not panic.
30 days before
Second reminder
Re-verify from last year’s answers.
7 days before
Final reminder
To the owner and the signer.
Missed it?
Shows as lapsed
The public page says so until you renew.
Triggers that reopen a question early
Regulation change
When guidance or the law behind a question changes, the affected questions are flagged for review.
Incident
Log a breach or incident and the related controls are reopened so the passport stays honest.
Evidence review date
Policies and certificates carry a review date. We nudge the owner before it passes.
New workflow version
When we improve an audit you see exactly what’s new and answer only those questions.
10Pricing
Start free. Grow when you need to.
One free audit to see how it works, then a simple monthly plan. Expert help is always a fixed price, shown before you pay.
Free
€0/ month
Try a self-audit and get a self-assessed passport.
Short, practical courses from the AuditGlass expert panel — for the person answering the questions, and for everyone they work with. Finish one and it counts as evidence in your audit.
Buy a single courseWatch, take the quiz, get a certificate with its learning hours.
AuditGlass LearningOne subscription, every course in the catalogue.
Seats for your teamAssign courses; completions attach to your audit as evidence.
Plain-English notes on the rules behind our audits.
EU AI Act5 min read
Using AI tools at work? Start with an inventory.
Before any AI Act question, know which AI tools your people already use, for what, and with whose data. A one-page inventory is where every answer starts.
No. GDPR essentials is free, and the Free plan includes one workflow run with a self-assessed passport and an action plan for every gap. You only pay if you want more audits, reminders or expert help.
No. Each audit is a structured self-assessment written in plain English, based on the framework it names. It shows where you stand and what to fix. When you need a professional opinion, ask an expert from the panel from inside the question.
Between 25 and 60 minutes, depending on the audit. Stages that don’t apply to you are skipped automatically, your answers save as you go, and you can stop and come back whenever you like.
Every question says who usually answers it — the secretary, the IT provider, the treasurer. Invite them as contributors, and ask a signer (a chair, director or owner) to confirm the result.
A self-assessed passport is issued as soon as your own answers reach the pass mark. An expert-verified passport is only issued after an AuditGlass panel expert has reviewed your answers and evidence, and the public verify page names it as verified.
A few questions matter so much that answering “No” caps your score at 59%, whatever else you answer — not having a privacy notice, for example. They’re marked in every audit so there are no surprises.
We remind you 60, 30 and 7 days before. Re-verifying starts from last year’s answers, so you only update what has changed. If it isn’t renewed in time, the public verify page shows the passport as lapsed.
Every question has a “Get help” button. Choose a quick written answer, a 45-minute session, a done-for-you document or an expert verification, all at a fixed price shown before you pay. The answer is filed against the question it belongs to.
All 8 questions
Ready to see it clearly?
GDPR essentials is free and takes about half an hour. No card needed.
