Agency Privacy Evidence Pack Checklist: Build and Verify Your GDPR Compliance Record

Introduction

*Updated for 2026 compliance practices.*

An **agency privacy evidence pack checklist** is a practical compliance tool for website owners, agencies, and data protection teams who need to validate consent, tags, and disclosures across their digital properties. Rather than treating privacy as a one-time policy update, this checklist helps you assemble a living evidence pack that demonstrates ongoing accountability under the GDPR. Whether you manage a single site or a portfolio of client domains, the checklist brings structure to what can otherwise feel like an overwhelming documentation burden.

This guide focuses on technical implementation and verification steps you can perform today. It is not legal advice, but it reflects the operational realities that regulators and partners increasingly expect to see. By the end, you will have a clear path to close common compliance gaps—especially around consent mode, cookie banners, and privacy policies—and a repeatable process for keeping your evidence pack current.

What Is an Agency Privacy Evidence Pack Checklist?

An agency privacy evidence pack checklist is a structured list of documents, screenshots, scan results, and configuration exports that together prove a website’s GDPR compliance posture at a given point in time. It goes beyond a simple privacy policy link by capturing the actual technical behaviour of the site: which tags fire before consent, how the cookie banner responds to user choices, and whether data subject rights processes are in place.

For agencies, the pack serves as a deliverable that demonstrates due diligence to clients. For in-house teams, it provides a defensible record for supervisory authority inquiries. The checklist typically covers:

Consent management platform (CMP) configuration and banner behaviour
Tag manager triggers and consent signals
Pre-consent network requests and data flows
Privacy policy content and accessibility
Data subject access request (DSAR) procedures
Regular scan reports from a tool like GDPRChecker

Because the GDPR requires ongoing compliance, not a one-time fix, the evidence pack should be versioned and updated after any significant change to the website or its data processing activities.

Core Components of the Checklist

An effective agency privacy evidence pack checklist includes both documentation and live verification items. Below are the essential components, each of which we will explore in detail.

1. Consent Mode and Tag Configuration Evidence

Consent mode is a mechanism that allows tags to adjust their behaviour based on user consent state. For Google services, Google Consent Mode lets you signal consent choices to tags like Google Analytics and Google Ads. If consent is denied, the tags can still fire in a cookieless mode, sending pings without storing identifiers.

Your evidence pack should include:

Screenshots of your CMP’s consent mode integration settings.
Exported tag configurations from Google Tag Manager or another tag management system, showing consent triggers.
A scan report from GDPRChecker confirming that tags do not set cookies before consent is obtained.

**Common mistake:** Assuming that enabling consent mode in your CMP is enough. You must also configure each tag in your tag manager to respect the consent signal. A tag that fires on “All Pages” without a consent trigger will ignore the user’s choice.

2. Cookie Banner and Consent Flow Evidence

The cookie banner is the most visible part of your compliance setup. Your evidence pack should document:

The banner’s appearance on desktop and mobile, including all text and button labels.
The behaviour when a user clicks “Accept All,” “Reject All,” or customises settings.
That the banner reappears if the user clears cookies or after a reasonable period (e.g., 6 months).
That it is not possible to interact with the site without making a choice (no implied consent).

Use GDPRChecker to scan the banner flow and verify that no tracking cookies are set before consent. The scanner can detect pre-consent network requests that might indicate a misconfiguration.

3. Privacy Policy and Disclosure Evidence

Your privacy policy must be accurate, up-to-date, and easily accessible. The evidence pack should contain:

A dated copy of the privacy policy as it appears on the site.
Screenshots showing the policy is linked from the cookie banner, footer, and any registration forms.
A record of when the policy was last reviewed and what changes were made.

Pay special attention to disclosures about data sharing with third parties, international transfers, and retention periods. If your site uses Google Analytics, your policy should mention this and link to Google’s consent mode documentation where appropriate.

4. Data Subject Rights (DSAR) Process Evidence

The GDPR grants individuals rights to access, rectify, erase, and port their data. Your evidence pack should demonstrate that you have a process to handle these requests within the one-month deadline. Include:

A documented internal procedure for receiving, verifying, and responding to DSARs.
A record of any DSARs received and how they were resolved (anonymised for privacy).
A test of your DSAR submission method (e.g., a dedicated email address or form) to confirm it works.

5. Regular Scanning and Monitoring Evidence

Compliance is not static. Your evidence pack should include dated scan reports from GDPRChecker that show the state of the website at regular intervals. These scans can detect:

New cookies or trackers that appeared without authorisation.
Changes in banner behaviour after a plugin update.
Missing or outdated privacy policy links.

Schedule scans after any website change and at least monthly. Keep the reports in your evidence pack to show ongoing monitoring.

Step-by-Step Implementation Guide

Building your first agency privacy evidence pack checklist can be broken down into manageable steps. Follow this sequence to ensure nothing is missed.

Step 1: Inventory Your Data Processing Activities

Before you can document compliance, you need to know what personal data your website collects and why. Create a simple spreadsheet listing:

Each cookie, tracker, or local storage item.
Its purpose (strictly necessary, analytics, marketing, etc.).
The provider (first-party or third-party).
The legal basis for processing (consent, legitimate interest, etc.).

This inventory will guide your consent configuration and privacy policy disclosures.

Step 2: Configure Your Consent Management Platform

If you haven’t already, implement a CMP that supports the IAB Europe Transparency & Consent Framework (TCF) or Google Consent Mode. Configure it to:

Block all non-essential tags by default.
Present a clear “Reject All” button that is as prominent as “Accept All.”
Store consent choices and respect them on subsequent visits.

Export the CMP configuration as a JSON or PDF file for your evidence pack.

Step 3: Set Up Tag Manager Triggers

In Google Tag Manager (or your chosen platform), create triggers that fire tags only when the appropriate consent is granted. For example:

Create a Custom Event trigger for `consent_update` or `consent_default`.
Use the Consent Initialisation trigger for tags that need to fire before consent (e.g., consent mode pings).
Ensure no marketing or analytics tags fire on the “All Pages” trigger without a consent condition.

Take screenshots of your trigger configurations and include them in the pack.

Step 4: Test Pre-Consent Behaviour

Use GDPRChecker to scan your website and verify that no tracking cookies are set before the user interacts with the banner. The scanner will list all network requests made on page load. Check that:

Requests to analytics or advertising domains only occur after consent.
If using consent mode, the `gcs` parameter is set correctly in requests to Google.
Strictly necessary cookies (like session cookies) are still allowed.

Save the scan report as evidence.

Step 5: Verify the Reject Flow

Many implementations fail the reject test. Click “Reject All” on your banner and then:

Reload the page and check that no tracking cookies appear.
Use GDPRChecker to scan again and confirm the reject state is respected.
Test that essential functionality (like login or shopping cart) still works.

Document the results with screenshots and a scan report.

Step 6: Review and Update Your Privacy Policy

Compare your privacy policy against the data inventory from Step 1. Ensure it:

Lists all cookies and trackers by category.
Explains how users can change their consent choices.
Provides contact details for data protection inquiries.
Is dated and versioned.

Save a copy of the policy and a screenshot of its location on the site.

Step 7: Establish a DSAR Procedure

Create a simple process document that covers:

How requests can be submitted (email, form, postal address).
How you will verify the requester’s identity.
The steps to gather, review, and redact personal data.
How you will respond within 30 days.

Test the process by submitting a request to yourself and documenting the response.

Step 8: Schedule Regular Scans and Reviews

Set a recurring calendar reminder to run a GDPRChecker scan at least monthly and after any website update. Add each scan report to your evidence pack with a date and any notes on changes made. Review the pack quarterly to ensure all components are current.

Common Mistakes and How to Avoid Them

Even experienced teams make mistakes when assembling an agency privacy evidence pack checklist. Here are the most frequent pitfalls and how to sidestep them.

Mistake 1: Assuming the CMP Handles Everything

A CMP is a tool, not a magic wand. It must be correctly configured and integrated with your tag manager and website. If you install a CMP but leave your Google Analytics tag firing on all pages without a consent check, the CMP’s banner is meaningless. Always test with a scanner.

Mistake 2: Ignoring Pre-Consent Network Requests

Some tags fire so early in the page load that they bypass the CMP. This can happen with hardcoded scripts in the `<head>` or with server-side tags. GDPRChecker can detect these requests. If you find any, move them behind the CMP or configure them to respect consent signals.

Mistake 3: Incomplete or Outdated Privacy Policy

A privacy policy that doesn’t mention all your trackers, or that was last updated two years ago, undermines your entire evidence pack. Review and update the policy whenever you add a new third-party service or change your data practices.

Mistake 4: No Evidence of the Reject Flow

Many teams only test the “Accept All” path. But regulators are increasingly focused on whether rejecting is as easy as accepting. Your evidence pack must include proof that the reject flow works correctly and that no tracking occurs after rejection.

Mistake 5: Treating the Pack as a One-Time Project

Compliance is ongoing. A pack created once and never updated is worse than no pack at all because it gives a false sense of security. Build a process for regular updates and stick to it.

How to Validate Your Evidence Pack with GDPRChecker

GDPRChecker provides a practical way to verify the technical aspects of your agency privacy evidence pack checklist. Here’s how to integrate it into your workflow:

**Baseline Scan:** Run a full scan of your website before making any changes. Save the report as your starting evidence.
**Post-Configuration Scan:** After setting up your CMP and tags, run another scan to confirm that pre-consent requests are blocked and the banner behaves correctly.
**Reject Flow Scan:** Use the scanner in a session where you have rejected all cookies. Verify that no tracking persists.
**Change Monitoring:** After any website update, plugin installation, or tag modification, run a new scan and compare it to the previous one. Look for new, unexpected requests.
**Scheduled Scans:** Automate monthly scans if possible, or set a recurring task. Keep all reports in a dated folder as part of your evidence pack.

The scanner helps you close the gap between what you think your site does and what it actually does. It’s an essential tool for building a credible evidence pack.

Implementation Checklist

Use this numbered checklist to build and maintain your agency privacy evidence pack. Check off each item as you complete it.

Create a data inventory listing all cookies, trackers, and their purposes.
Implement a CMP that supports consent mode and the TCF, if applicable.
Configure the CMP to block all non-essential tags by default and provide a prominent “Reject All” button.
Set up tag manager triggers that fire only after appropriate consent is received.
Run a GDPRChecker baseline scan and save the report.
Test the pre-consent state: verify no tracking cookies or requests before user interaction.
Test the “Accept All” flow and confirm that all consented tags fire correctly.
Test the “Reject All” flow and confirm that no tracking tags fire and essential functionality remains.
Review and update your privacy policy to match the data inventory; save a dated copy.
Document your DSAR procedure and test it with a mock request.
Schedule recurring GDPRChecker scans (at least monthly) and after every site change.
Compile all evidence into a dated, versioned pack and store it securely.

Comparison: Manual vs. Scanner-Assisted Evidence Gathering

| Aspect | Manual Evidence Gathering | Scanner-Assisted (GDPRChecker) | |--------|---------------------------|--------------------------------| | **Pre-consent request detection** | Requires browser DevTools and manual inspection; easy to miss requests | Automated detection of all network requests on page load | | **Consistency** | Depends on the person performing the check; may vary | Standardised reports that can be compared over time | | **Time per check** | 30–60 minutes per site | 5 minutes per scan | | **Documentation** | Screenshots must be taken manually and organised | Dated, exportable reports ready for the evidence pack | | **Change detection** | Manual comparison of screenshots; error-prone | Side-by-side scan comparisons highlight new or missing elements | | **Reject flow verification** | Must manually clear cookies and retest; tedious | Scanner can simulate a clean session and verify reject state |

While manual checks are possible, a scanner dramatically reduces the effort and increases the reliability of your evidence pack. For agencies managing multiple sites, it’s practically essential.

Real-World Examples

Example 1: The Missing Consent Trigger

A small e-commerce site installed a CMP and assumed it was compliant. A GDPRChecker scan revealed that their Facebook Pixel was firing on page load before any consent was given. The tag was set to fire on “All Pages” without a consent trigger. After adding a consent trigger and rescanning, the pre-consent request disappeared. The evidence pack now includes both the failing and passing scan reports to show the correction.

Example 2: The Broken Reject Button

A SaaS company’s cookie banner had a “Reject All” button, but clicking it did not actually block analytics cookies because the CMP was misconfigured. A GDPRChecker scan in the reject state showed that Google Analytics cookies were still being set. The team fixed the CMP settings and documented the before-and-after scans in their evidence pack.

Example 3: The Outdated Privacy Policy

An agency discovered during a routine evidence pack review that a client’s privacy policy still listed a retired analytics tool and omitted a new chatbot service. They updated the policy, saved a dated copy, and added a note to the pack explaining the change. This proactive update prevented a potential compliance gap.

FAQ

What is an agency privacy evidence pack checklist? It is a structured collection of documents, screenshots, scan reports, and configuration exports that demonstrate a website’s GDPR compliance. It covers consent management, tag behaviour, privacy policy accuracy, and data subject rights processes, providing a defensible audit trail for regulators or clients.

Do I need an agency privacy evidence pack checklist for GDPR? Yes, if you want to demonstrate accountability under GDPR Article 5(2). While not explicitly named in the regulation, an evidence pack is the practical way to show you have implemented appropriate technical and organisational measures and can prove it when asked.

How do I implement an agency privacy evidence pack checklist? Start with a data inventory, configure your CMP and tag manager correctly, test pre-consent and reject flows with a scanner like GDPRChecker, update your privacy policy, document your DSAR procedure, and schedule regular scans. Compile all outputs into a dated, versioned pack.

How can I verify my agency privacy evidence pack checklist with a scanner? Use GDPRChecker to run baseline and post-configuration scans. Verify that no tracking cookies or requests occur before consent, that the reject flow works, and that new tags don’t appear after site changes. Save each scan report as dated evidence in your pack.

What are common agency privacy evidence pack checklist mistakes? Common mistakes include assuming the CMP alone ensures compliance, ignoring pre-consent network requests, having an outdated privacy policy, failing to test the reject flow, and treating the pack as a one-time project instead of a living document.

Which cookies and trackers should I check for my agency privacy evidence pack checklist? Check all cookies and trackers that are not strictly necessary for the website’s core functionality. This includes analytics (e.g., Google Analytics), marketing (e.g., Facebook Pixel), and any third-party embeds that set cookies. Your data inventory should list them all.

How often should I review my agency privacy evidence pack checklist? Review the pack at least quarterly and after any significant website change, such as a new plugin, tag, or data processing activity. Run a GDPRChecker scan monthly to catch unexpected changes early.

What evidence should I keep for my agency privacy evidence pack checklist? Keep CMP configuration exports, tag manager trigger screenshots, pre-consent and post-consent scan reports, dated copies of your privacy policy, records of DSAR procedures and tests, and logs of any consent-related changes or incidents.

Next Steps for Your Compliance Journey

Building an agency privacy evidence pack checklist is a significant step toward demonstrable GDPR compliance. It moves you from a reactive, policy-only approach to a proactive, evidence-based posture. Start with a single website, follow the implementation checklist above, and use GDPRChecker to validate each stage.

For deeper dives into related topics, explore our guides on GDPR requirements for websites, cookie banner requirements, and privacy policy requirements. If you manage multiple client sites, our GDPR compliance for SaaS companies guide offers additional insights. And for a broader overview, see what is GDPR and our GDPR checklist for small businesses.

Ready to verify your setup? Run a GDPRChecker scan now and start building your evidence pack with confidence.

Article schema

```json { "@context": "https://schema.org", "@type": "Article", "headline": "Agency Privacy Evidence Pack Checklist: Build and Verify Your GDPR Compliance Record", "description": "Learn how to build an agency privacy evidence pack checklist for GDPR website compliance. Step-by-step guide with scanner verification, common mistakes, and implementation checklist.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/agency-privacy-evidence-pack-checklist" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```

Copyright and editorial notice

This original AI-assisted editorial draft was selected, reviewed, and published by GDPRChecker. All rights are reserved where protected by applicable law. Do not reproduce the article without permission.