Microsoft does not require an independent review of GDPR conformance for the Microsoft 365 Certification, as this is an either/or scenario where we will accept self-attestation's which we can independently verify when no external review has taken place. As this is more of an assessment than an audit, and with respect to the evidence for us to collect during our processes - reviewing privacy policies and internal processes is how we have approached GDPR control. For the purposes of what we are looking for in the GDPR control, it mostly involves reviewing privacy policies to ensure they meet basic GDPR requirements; e.g. what personal data is being processed, what the lawfulness of processing is, pointing out data subject rights, how a subject access request (SAR) will be performed by a user, how the ISV will undertake SARs, the ISVs company details and data retention details.