UK GDPR Evidence Packs: The Pen Test Reports Mobile Agencies Show Their Clients

Why UK GDPR mobile security assurance is now a sales question

UK GDPR mobile security assurance is now a sales question because it has moved from a legal footnote to a procurement gate. Clients’ compliance leads and data protection officers ask how an app’s security has been tested, and “we follow secure coding practices” no longer closes the question.

The apps you ship process personal data on behalf of your clients, which makes the client the controller and you, in most engagements, a processor. What they want is evidence they can file, show their own auditors and defend to the ICO if a breach ever puts the app under scrutiny.

That evidence request lands on the agency, because it is your codebase, your build pipeline and your API design under examination. Agencies that can hand over a recent penetration test report from an accredited firm answer the question in one email. Agencies that cannot face weeks of security questionnaires, or lose the renewal to a competitor who can.

What UK GDPR actually requires, and what it does not

UK GDPR requires “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing” under Article 32. It never mandates a penetration test, and the regulation is technology neutral.

The ICO’s remit covers whether your testing regime is appropriate to the risk.

In our experience, penetration testing is the most common way to evidence that process for a mobile app. ICO security guidance points to vulnerability scanning and penetration testing as examples of appropriate testing, and organisations that suffer breaches without any independent testing struggle to argue their measures were adequate. The obligation scales with risk: an app handling health, financial or children’s data needs deeper and more frequent testing than a low-risk utility app.

Two further hooks matter to agencies. Privacy by design under Article 25 expects security to be considered while the app is being built, the phase where the agency holds the pen. And Article 28 requires controllers to use only processors providing “sufficient guarantees” of appropriate security. A current pen test report is the cleanest guarantee an agency can offer, which is why it keeps appearing in client contracts and due diligence packs.

What goes in a client-ready evidence pack

From the engagements we run for mobile developers and agencies, the pack that survives a client compliance review contains four things:

• The full technical report: scope, methodology, findings rated by severity, and evidence for each finding.
• An executive summary the client can forward to non-technical stakeholders, their insurer or their own customers without exposing exploit detail.
• A retest confirmation or letter of attestation showing the significant findings were fixed and verified. An unremediated report is a liability, not an asset.
• The tester’s credentials: the accreditation of the firm and confirmation the work was carried out by UK-based testers.

Timing matters as much as content. A report dated three years ago evidences nothing about the app running today. Most agencies test each major release or annually, whichever comes first, and reference the cadence in their master services agreement.

What to test in a mobile estate

Personal data in a mobile product rarely lives in the app binary alone, so a credible evidence pack covers the whole path the data takes. A typical scope has three layers:

The app itself. Mobile application penetration testing against the OWASP Mobile Application Security Verification Standard covers insecure local storage, weak certificate validation, hardcoded secrets and reverse engineering resistance on iOS and Android builds.

The API behind it. Almost every serious mobile finding we report sits server side. Broken object-level authorisation, where one user can retrieve another user’s records by changing an identifier, is the single most common way personal data leaks from a mobile product. API penetration testing should be scoped alongside the app, not as an optional extra.

The cloud backend. Storage buckets, push notification services and third-party SDK data flows all touch personal data. Where the agency also manages the client’s cloud environment, a configuration review through cloud penetration testing closes the loop.

How an engagement runs

An engagement starts with a short scoping call built around a data flow question: what personal data the app collects, where it goes and which components the agency controls. Testing runs against release-candidate builds in staging wherever possible, so production data is never touched.

From that call we agree the builds to test, test accounts for each user role and any API documentation needed before work starts.

Testing runs over the agreed days with a same-day heads-up for anything critical. Reporting lands within a week, findings mapped to severity and to the UK GDPR security principle they touch, so the client’s compliance lead can read it without translation. A free retest of fixed findings produces the remediation confirmation that completes the pack. Before scoping, our penetration testing checklist covers what to have ready.

What it costs and how scope drives the price

Mobile pen testing in the UK is priced on tester days. Our day rate runs from £1,200 to £1,400 depending on the engagement, and the day count follows the size of the estate: number of platforms, count of user roles, and how large the API surface is.

Scope	Typical days	Typical range
Single-platform app plus core API	4 to 6	£4,800 to £8,400
iOS and Android plus full API surface	6 to 9	£7,200 to £12,600
App, API and cloud backend review	8 to 12	£9,600 to £16,800

These are typical UK ranges, not quotes; the exact figure depends on your scope, and a short scoping call fixes the price before any work starts. The lever that keeps cost proportionate is following the personal data rather than testing every screen by reflex. We break down how day counts map to budget across engagement types in our guide to penetration testing cost in the UK.

How EJN Labs approaches mobile evidence packs

EJN Labs is a CREST-accredited penetration testing firm, and we hold Cyber Essentials Plus, ISO 27001 and ISO 9001 ourselves, so the report your client files carries the weight of an independently assessed provider. All testing is delivered by UK-based testers, which matters when the client’s data residency commitments say UK personnel only.

Because we work with agencies as well as end clients, we write two audiences into every report: technical findings your developers fix, and an executive summary for the client’s compliance lead. Findings reference the OWASP MASVS control and the relevant UK GDPR security expectation, and the retest letter comes in a form your client can hand to insurers or enterprise customers.

Frequently Asked Questions

Does UK GDPR require a penetration test for mobile apps?

No clause of UK GDPR mandates a penetration test for mobile apps. What Article 32 requires is a process for regularly testing, assessing and evaluating the effectiveness of security measures, proportionate to the risk of the processing, and a pen test is one way to run that process.

The ICO accepts penetration testing as strong evidence of that process, and for mobile apps handling personal data it has become the standard way to demonstrate compliance to clients and regulators.

What does a mobile app penetration test cost in the UK?

Expect £4,800 to £12,600 for most engagements, priced at £1,200 to £1,400 per tester day. A single-platform app plus its core API usually takes four to six days, £4,800 to £8,400, while testing iOS and Android with a full API surface runs six to nine days, £7,200 to £12,600.

Exact pricing depends on scope, which a short scoping call fixes before work starts.

Who pays for the test, the agency or the client?

Either model works. Some agencies commission testing themselves and treat the evidence pack as part of their offer, recovering the cost through the retainer, while others pass it through as a project line item, since the report is a deliverable the client keeps.

What matters contractually is that the controller can show sufficient guarantees under Article 28, so agree who holds the report and who may share it.

How often should the evidence pack be refreshed?

Refresh the pack annually or on each major release, whichever comes first, and after any significant change to authentication, data storage or the API. Article 32 asks for regular testing, and a report loses evidential value as the codebase moves away from the build that was tested.

That is the cadence most mobile agencies work to, and writing it into your master services agreement keeps the cost planned rather than reactive.

Can the client share our pen test report with their customers?

Not the full report, which contains exploit detail you should not circulate widely. The usual approach is a tiered pack: the client’s security team sees the full report under confidentiality, while wider audiences receive the executive summary and a letter of attestation confirming testing and remediation.

Agree the sharing tiers in writing when the engagement is scoped, so nobody forwards the wrong document.

Give your clients the evidence pack before they ask

If your agency ships apps that process personal data, the next security questionnaire is already on its way. A scoped mobile and API test from a CREST-accredited firm turns it into a one-email answer. Tell us about the app and we will come back with a fixed scope and price: get a CREST pen testing quote.