GDPR audit – review of personal data processing compliance
An audit shows how the organisation actually processes personal data and where practice or documentation departs from the GDPR.
Scope of the audit
- Inventory of processing operations and categories of personal data.
- Review of legal bases and fulfilment of information obligations.
- Review of the record of processing activities, authorisations and processing agreements.
- Assessment of technical and organisational measures under Article 32 GDPR.
- Review of procedures for data subject rights and breach notification.
- Analysis of transfers to third countries.
Outcome
The result is a report identifying non-compliance, assessing its risk and setting out the order of remediation steps – a basis for management decisions and for the work of the data protection officer or legal team.
An audit is advisable before implementing a new system, after organisational changes, before an expected inspection or after a data breach.
Frequently asked questions
Is a GDPR audit mandatory?
The GDPR does not expressly require an audit. However, the controller must regularly test, assess and evaluate the effectiveness of security measures (Article 32(1)(d) GDPR) and demonstrate compliance. An audit is the standard way to meet these obligations.
Let us discuss your matter
The first conversation is used to define the scope of the matter and the fee.