GDPR Audit Guide: Preparing for and Conducting Compliance Audits

Key Takeaways

Point	Summary
No formal certification	GDPR compliance is demonstrated through ongoing practices, not a certificate
Accountability principle	Article 5(2) requires organizations to demonstrate compliance
Multiple audit types	Internal audits, customer assessments, regulatory investigations
Documentation essential	Audit readiness depends on comprehensive, current documentation
Continuous process	Regular audits help maintain compliance over time

Quick Answer: GDPR compliance is demonstrated through documentation and practices, not certification. Prepare for audits by maintaining comprehensive records (ROPA, policies, consent records, DPAs), conducting regular internal reviews, and ensuring staff understand their responsibilities.

Types of GDPR Audits

Internal Compliance Audits

Regular self-assessment to identify gaps and ensure ongoing compliance:

Purpose	Frequency
Verify policies are followed	Quarterly to annually
Identify emerging gaps	Ongoing monitoring
Prepare for external scrutiny	Before customer audits
Satisfy accountability requirements	As needed

Customer Due Diligence

Enterprise customers often assess vendor GDPR compliance:

Context	Common Approach
Sales process	Security questionnaires
Contract negotiation	DPA review
Ongoing relationship	Periodic assessments
Incident response	Post-breach review

Regulatory Investigations

Supervisory authorities may audit organizations following complaints or as proactive enforcement:

Trigger	Scope
Complaint	Specific to complaint subject
Breach notification	Breach circumstances and response
Proactive enforcement	Broader compliance assessment
Sector sweep	Industry-wide investigation

Audit Readiness Framework

Documentation Checklist

Core Documentation:

Document	Purpose	Review Frequency
ROPA	Record of all processing activities	Quarterly
Privacy Policy	Transparency requirements	Annually
Cookie Policy	Cookie consent documentation	Annually
Data Retention Schedule	Storage limitation compliance	Annually
Information Security Policy	Security measure documentation	Annually

Process Documentation:

Document	Purpose	Review Frequency
DSAR Procedures	Rights handling processes	Annually
Breach Response Plan	Incident response procedures	Annually
Consent Management Procedures	Consent collection and records	Annually
Vendor Management Procedures	Third-party oversight	Annually
Training Program	Staff awareness documentation	Annually

Contracts and Agreements:

Document	Purpose	Review Frequency
DPAs with processors	Processor relationships	On renewal
International transfer mechanisms	SCCs, TIAs	Annually
Employee agreements	Staff data protection obligations	On hire
Confidentiality agreements	Appropriate confidentiality	As needed

Evidence Records:

Record	Purpose	Retention
Consent records	Demonstrate valid consent	Duration of processing + limitation period
DSAR handling records	Demonstrate compliant response	3-6 years
Breach records	Demonstrate proper response	5+ years
Training records	Demonstrate staff awareness	Duration of employment + 2 years
Audit records	Demonstrate accountability	5+ years

Technical Audit Areas

Area	What to Verify
Access controls	Appropriate access restrictions, regular reviews
Encryption	Data protected at rest and in transit
Logging	Audit trails for data access and changes
Retention	Data deleted according to schedule
Security testing	Regular vulnerability assessments
Backup/recovery	Data protection in backups

Conducting Internal Audits

Audit Planning

Step 1: Define Scope

Element	Consideration
Processing activities	Which activities to audit
Locations	Physical and system locations
Time period	Data range to examine
Depth	High-level vs. detailed testing

Step 2: Gather Documentation

• Collect current versions of all relevant documents
• Request evidence of recent activities
• Identify key personnel to interview

Step 3: Develop Audit Program

Component	Description
Control objectives	What compliance looks like
Test procedures	How to verify compliance
Evidence requirements	What documentation to examine
Interview questions	Topics for personnel discussions

Audit Execution

Document Review:

Document	Review Focus
ROPA	Completeness, accuracy, currency
Policies	Coverage, clarity, implementation
Procedures	Alignment with policies, practical application
Contracts	Completeness, compliance, execution
Records	Evidence of processes being followed

Process Testing:

Process	Test Approach
Consent collection	Sample consent records, test mechanisms
DSAR handling	Review sample requests, check timelines
Vendor management	Sample DPA review, security assessments
Access management	Review access logs, permission checks
Incident response	Test procedures, review past incidents

Technical Testing:

Area	Test Approach
Encryption	Verify configuration and implementation
Access controls	Attempt unauthorized access, review permissions
Data retention	Check for data beyond retention period
Logging	Verify logs exist and are protected

Audit Reporting

Report Structure:

Section	Content
Executive Summary	Overall assessment, key findings, recommendations
Scope and Methodology	What was audited and how
Findings	Issues identified with severity ratings
Recommendations	Specific actions to address findings
Management Response	Agreed actions and timelines

Finding Severity Levels:

Level	Definition
Critical	Significant compliance gap requiring immediate action
High	Material gap requiring prompt remediation
Medium	Issue requiring attention but lower risk
Low	Minor issue or improvement opportunity
Observation	Area for consideration, not a finding

Customer Audit Preparation

Common Customer Questions

Organizational Controls:

Question Area	What Customers Ask
Governance	Privacy leadership, DPO, responsibilities
Policies	What policies exist, how maintained
Training	Staff awareness, role-specific training
Risk management	How privacy risks are identified and managed

Technical Controls:

Question Area	What Customers Ask
Access management	How access is controlled and reviewed
Encryption	What encryption is used, key management
Security testing	Penetration testing, vulnerability scanning
Incident response	Breach detection and response capabilities

Data Handling:

Question Area	What Customers Ask
Data mapping	Understanding of data flows
Retention	How long data is kept, deletion processes
International transfers	Transfer mechanisms and safeguards
Sub-processors	Vendor oversight and management

Responding to Questionnaires

Best Practice	Implementation
Be accurate	Provide truthful, verifiable responses
Be complete	Answer all questions fully
Provide evidence	Attach supporting documentation
Meet deadlines	Respond within requested timeframe
Note limitations	Be clear about scope or caveats

Audit Rights in DPAs

Most DPAs include audit rights. Understand your obligations:

Aspect	Consideration
Notice period	How much notice before audit
Scope	What can be audited
Frequency	Limits on audit frequency
Confidentiality	Protecting audit findings
Cost allocation	Who bears audit costs

Regulatory Audit Response

Receiving a Regulatory Inquiry

Immediate Actions:

Action	Timeline
Log receipt	Immediately
Notify appropriate personnel	Within hours
Engage legal counsel	Within 24 hours
Acknowledge receipt	Per authority requirements
Preserve evidence	Immediately

Assessment:

Question	Action
What is being requested?	Review thoroughly, seek clarification if needed
What is the deadline?	Note carefully, request extension if necessary
What's the investigation scope?	Understand what's being investigated
Who needs to be involved?	Identify internal stakeholders

Responding to Authority Requests

Principle	Application
Cooperate	Non-cooperation is itself a violation
Be accurate	Provide truthful information
Be complete	Don't omit relevant information
Meet deadlines	Or request extensions in advance
Document	Keep records of all interactions
Protect privilege	Legal advice may be privileged

Demonstrating Accountability

During regulatory audits, demonstrate:

Element	Evidence
Awareness	Training records, communications
Planning	Policies, procedures, risk assessments
Implementation	Technical controls, process evidence
Monitoring	Audit records, metrics, reviews
Improvement	Corrective actions, updates

Audit Frequency Recommendations

Activity	Recommended Frequency
Full GDPR compliance audit	Annually
ROPA accuracy review	Quarterly
Policy currency check	Annually
DSAR process review	Bi-annually
Consent mechanism audit	Annually
Vendor DPA review	On renewal/annually
Security controls test	Annually (or per security program)
Training completion check	Quarterly
Breach response drill	Annually

How Bastion Helps

Audit preparation and response benefit from experienced guidance. Working with partners who understand what auditors look for helps ensure your compliance program is demonstrably effective.

Challenge	How We Help
Audit Readiness Assessment	Evaluate preparedness, identify gaps
Documentation Review	Ensure documentation is comprehensive and current
Mock Audits	Practice audit responses before customer or regulatory review
Questionnaire Support	Help completing customer security questionnaires
Regulatory Response	Guidance during supervisory authority interactions
Remediation	Support addressing findings from audits

Being audit-ready demonstrates the accountability GDPR requires. Expert support helps ensure your documentation and practices tell a compelling compliance story.

---

Looking for help with GDPR audit preparation? Talk to our team →