Data Protection Audit

A data protection audit assesses whether an organisation's processing of personal data complies with the data protection legislation in force (GDPR, national data protection laws and the like). It differs from a cyber security audit in that the focus is LAWFUL PROCESSING rather than protection of the data as such.

The aim is to identify non-compliance that gives rise to administrative fines and reputational risk, and to verify that data subjects' rights are protected.

• Organisations processing personal data intensively
• Companies operating in the EU or providing services to the EU under the GDPR
• Technology firms providing services as a data processor
• Suppliers whose customers request data-protection assurance
• Organisations establishing ISO/IEC 27701

The criteria are applicable data-protection legislation (KVKK, GDPR) together with a privacy management system standard such as ISO/IEC 27701, if any. Sector regulations and the data-processing terms in customer contracts are also added.

• The personal-data inventory and record of processing activities
• The lawful basis of processing activities
• Privacy notices and consent management
• Data-subject rights processes and response times
• Data minimisation and retention periods
• The destruction policy and actual destruction records
• Data-processing agreements and sub-processor management
• Cross-border data transfers and their legal basis
• Processing activities requiring a data protection impact assessment (DPIA)
• The adequacy of technical and organisational measures
• Data-breach detection, notification and record-keeping processes
• Employee awareness and confidentiality undertakings
• Appointment of a contact person or a data protection officer

• ISO/IEC 27701
• ISO/IEC 27001
• ISO/IEC 29134
• ISO 19011

1. 1Selecting the Criteria to ApplyThe standard, scheme or legislation against which the audit will be performed is determined; in subject-specific audits the choice of criteria directly determines what the result means.
2. 2Risk Assessment and ScopeRisk areas are identified according to the organisation's activity and location; the number of audit days is planned accordingly.
3. 3Review of Documents and RecordsPolicies, procedures, permits, measurement records and the results of previous audits are examined.
4. 4On-site AuditThe relevant areas are walked; subject-specific measurements, observations and record checks are made.
5. 5Worker InterviewsWhere the subject requires it, confidential interviews with workers are held independently of management; statements are compared with the records.
6. 6Assessment of Legal ComplianceCompliance with the legislation in force is checked separately; a legal nonconformity is the most serious category of finding in every scheme.
7. 7Reporting of FindingsFindings are classified by severity and compiled into a report.
8. 8Corrective Action and Follow-upA corrective action plan is obtained; its close-out within the period prescribed by the scheme is followed up.

The most severe findings are processing with no lawful basis, expired data not being destroyed, and the absence of a breach-notification process. These carry a direct risk of administrative sanction.

• Details of the audit body, the auditor and the auditee
• Standard, scheme or legislation applied
• Date, duration and scope of the audit
• Findings from the review of documents and records
• On-site observations and measurement results
• Findings from worker interviews, where held
• Assessment of legal compliance
• Findings, their severity and the supporting evidence
• Corrective action plan and time limits

A data protection audit is a technical and procedural assessment; it is not a legal opinion. Interpreting the legislation and a binding assessment of whether a processing activity is lawful is a matter for the competent supervisory authority. The audit report is not a compliance certificate or a document that provides protection before the authority.

Accreditation differs with the type of audit. Third-party audits underpinning management system certification are carried out under ISO/IEC 17021-1 and those underpinning product certification under ISO/IEC 17065; these scopes are subject to accreditation. First- and second-party audits, and audits governed by a scheme owner's own rules (such as SMETA or amfori BSCI), do not fall within accredited certification; they are conducted following the ISO 19011 guidance and produce a report. EUROLAB holds internationally recognised accreditation under ISO/IEC 17021-1 and ISO/IEC 17065, granted by accreditation bodies that are signatories to the IAF multilateral recognition arrangement; which audits can be offered within accredited scope is confirmed in writing at the quotation stage.

• Social Compliance Audit
• Environmental Audit
• OHS Audit
• Energy Audit
• Cybersecurity Audit
• ESG Audit