A GDPR compliance audit is an essential step in guaranteeing that companies comply with the General Data Protection Regulation (GDPR). Since it became applicable in May 2018, this regulation has imposed strict obligations on the processing of personal data within the European Union. But how can you make sure that your company is actually compliant? This article guides you through the steps of a GDPR compliance audit and offers solutions for effectively protecting your customers’ and partners’ data.
This article focuses on the compliance audit. For an overview of the GDPR (principles, legal obligations and penalties), see our complete guide to the GDPR.
What is a GDPR compliance audit?
Definition and objectives of the GDPR audit
A GDPR compliance audit consists of assessing and reviewing the processes for processing personal data within a company. The aim is to make sure that data is collected, processed and stored in compliance with the rules of the GDPR. In other words, it makes it possible to guarantee that the company respects the rights of data subjects and puts in place the security measures needed to protect data against the risk of breaches.
Why is the GDPR audit essential?
The GDPR audit is crucial for several reasons:
- Legal compliance: failure to comply with the GDPR exposes companies to financial penalties of up to 20 million euros or 4% of total worldwide annual turnover.
- Protecting reputation: a data breach can have disastrous consequences for a company’s reputation, particularly in a context where the protection of personal data has become a priority for consumers.
- Optimising internal processes: an audit makes it possible to identify gaps in data management systems and to put in place corrective actions to improve the security of sensitive information.
When and why should you carry out a GDPR compliance audit?
Frequency of GDPR audits
It is recommended to carry out a GDPR compliance audit regularly, depending on the size of the company and on changes in its data processing practices. The CNIL (Commission nationale de l’informatique et des libertés, the French data protection authority) does not set a frequency for the compliance audit. Its guide to the security of personal data (2024) recommends periodic security audits and a management review of IT risks at least once a year. In addition, an audit may be necessary in certain specific contexts, such as:
- A major change in the company’s processes (new projects, introduction of new data processing tools, etc.).
- The arrival of new subcontractors or partners processing personal data.
- The integration of new regulations or updates to the GDPR.
Signs that it is time to carry out a GDPR audit
Certain situations may indicate that a compliance audit is needed:
- Changes in legislation on data protection.
- Recurring security problems or data breach incidents.
- A lack of visibility of the data processing carried out by the company.
The key steps of a GDPR compliance audit
Preparing the audit
Preparation is a crucial phase, because it lays the foundations of the audit and makes sure that all the necessary resources are available. For this step, here are the main points to consider:
Define the objective of the audit: before starting, it is essential to understand clearly what you want to audit. This can be an overall audit of data management practices, or a more targeted audit, for example of the processing of sensitive data.
Set up an audit team: it is recommended to form an internal team or to call on a specialised external consultant to carry out the audit. The team must include members from different functions of the company: the DPO, the CISO, and representatives of the IT and business teams that process or handle personal data. Cross-departmental collaboration is often the key to getting a complete overall view.
Collect the documentation: this phase involves collecting the necessary documents, such as:
- Record of processing activities: this document describes all the data processing activities in the company. It is essential for starting the audit.
- Privacy policy and other internal policies.
- Agreements with subcontractors: they must be reviewed to guarantee that the company’s partners also comply with the GDPR.
- Data protection impact assessments (DPIAs) for processing operations likely to result in a high risk to the rights and freedoms of individuals.
Analysing data processing activities
This step is at the heart of the audit. It involves analysing in depth the data processed by the organisation and making sure that it is processed in compliance with the requirements of the GDPR.
Identifying the data collected: it is crucial to draw up an exhaustive inventory of all the personal data processed by the organisation. This can include:
- Identification data: surname, first name, address, telephone number.
- Financial data: bank details, payment information.
- Sensitive data: health information, ethnic origin, political opinions, etc.
Mapping of processing activities: this mapping consists of identifying where and how this data is collected, processed, stored and shared. Each data processing activity must be documented, taking into account:
- The purpose of the processing.
- The data retention period.
- The legal bases that justify this processing (consent, contract, legal obligation, etc.).
Assessing legal bases: each processing activity must be linked to a valid legal basis that complies with the requirements of the GDPR. Article 6 provides for six, including:
- The consent of the data subjects (it must be explicit only in certain cases, for example for the sensitive data covered by Article 9).
- The performance of a contract to which the data subject is party.
- Compliance with a legal obligation (for example, tax obligations).
Assessing the retention period: the GDPR requires that data must not be kept for longer than is necessary for the purpose for which it was collected. An audit must check that data retention and deletion policies are in place, and that they are applied in practice.
Checking the protection of data subjects’ rights
The rights of the individuals concerned by the processing of personal data are a central pillar of the GDPR. The audit must make sure that the company is able to respect these rights and to respond to them within the time limits set by the regulation.
Right of access: individuals must be able to access the data concerning them easily and obtain information on how their data is processed. This includes the right to know the purpose of the processing, the recipients of the data and the retention period.
Right to rectification: the company must allow data subjects to correct their data if it is inaccurate or incomplete. The audit must check that a simple process exists for doing so.
Right to erasure (right to be forgotten): this right allows individuals to request the deletion of their data under certain conditions (data no longer necessary, withdrawal of consent, etc.). The audit checks that these requests are handled within a reasonable time and that the procedures are properly documented.
Right to data portability: individuals must be able to retrieve their data in a structured, commonly used and machine-readable format, so that they can transfer it to another controller if they wish. The audit must make sure that this right is operational.
Right to restriction of processing: the company must allow individuals to restrict the use of their data in certain cases (for example, when the accuracy of the data is contested).
Reviewing security measures
The GDPR requires appropriate technical and organisational measures to ensure a level of security appropriate to the risk. During the audit, it is essential to check the security arrangements put in place to protect personal data.
Data encryption: check whether sensitive data is encrypted, particularly when it is transferred over public networks or stored.
Access control: it is important that only authorised persons can access personal data. An audit must assess access management policies, including the use of role-based access control (RBAC) systems.
Anonymisation and pseudonymisation: in some cases, it may be necessary to anonymise or pseudonymise data to limit the risks in the event of a leak or unauthorised access. The audit must check whether these techniques are used appropriately.
Continuity plans and incident management: the audit must make sure that disaster recovery plans are in place in the event of a data breach, and that data breaches are notified to the competent authorities (for example, the CNIL) within 72 hours of their discovery, in accordance with the requirements of the GDPR.
Writing the audit report and action plan
Once the audit is complete, the team must write a detailed report that presents the results of the audit and the actions to be taken to correct the non-compliance identified.
Summary of results: the report must provide an overall view of the company’s state of compliance, highlighting its strengths as well as its gaps.
Prioritising corrective actions: all non-compliance must be ranked in order of priority, according to its impact on data security and the risks to the rights of data subjects.
Putting an action plan in place: a correction plan must be drawn up to close the gaps identified. Each action must be assigned to a responsible team or person, with precise deadlines.
Monitoring actions: once the action plan is in place, it is essential to plan regular follow-up to make sure that the corrective measures are actually implemented and that the company remains compliant with the GDPR.
Tools and solutions for carrying out an effective GDPR audit
Manual tools and software for compliance audits
Several tools can make it easier to carry out a GDPR audit:
- Specialised SaaS solutions make it possible to automate the monitoring of compliance actions and to simplify the management of risks relating to personal data.
- Tools such as processing management software make it possible to centralise and document all the information relating to personal data, thus ensuring better governance of compliance.
Integrating GDPR compliance management into the overall cybersecurity strategy
It is important not to treat the GDPR in isolation, but rather to integrate it into an overall cybersecurity strategy. By adopting a unified approach, the company can both comply with regulatory requirements and protect its information systems against external threats. A platform that covers both cybersecurity and regulatory compliance gives an overall view for steering both aspects centrally.
Common mistakes to avoid during a GDPR compliance audit
Neglecting certain types of sensitive data
Some companies may underestimate the importance of certain data, such as indirect data or data contained in unstructured files (emails, Excel files, etc.). It is crucial to map all the data processed so as to leave nothing out.
Not involving all stakeholders
An effective GDPR audit requires the participation of all the teams concerned: the DPO and IT managers, but also HR and the business teams that handle data on a daily basis.
Underestimating subcontractors
Subcontractors that process data on behalf of the company must also be subject to strict checks. It is important to review their subcontracting agreements and to make sure that they comply with the requirements of the GDPR.
A GDPR compliance audit is a key step in guaranteeing that your company complies with the data protection rules in force. By following the steps detailed in this article and adopting a solution dedicated to compliance management, you can not only avoid financial penalties, but also protect your company’s reputation and strengthen your customers’ trust.
Frequently asked questions (FAQ)
What is the difference between an internal and an external GDPR audit?
An internal audit is carried out by the company’s own teams, while an external audit is conducted by an external provider or a specialised consultancy.
How long does a GDPR compliance audit take?
The length of a GDPR audit depends on the size of the company and the complexity of its data processing activities. It can range from a few days to several weeks.
What penalties can be incurred for GDPR non-compliance?
Penalties can reach up to 20 million euros or 4% of worldwide annual turnover, depending on the seriousness of the breaches.
What is the role of the DPO in a GDPR compliance audit?
The DPO advises and monitors: responsibility for GDPR compliance remains with the controller. The DPO often coordinates the audit and checks that the company takes the measures needed to comply with data protection rules.
