GDPR compliance audit: is it mandatory?

It is an essential tool to ensure the effectiveness of the measures decided by the data controller. The audit is carried out among people who take direct part in data processing. It then allows you to take stock of the application of the procedures defined beforehand within the organization. Carrying out an audit also makes it possible to meet the principle of accountability. This principle requires the data controller to keep concrete proof of the compliance process.

To understand audits relating to GDPR compliance, three main families of audits must be considered.

• The first family includes organizational audits. These are the audits which concern the management of personal data by your structure.
• There are also technical audits, including the physical and logical security of your organization.
• Finally, more legal audits allow you to identify and review all the documentation required to be compliant. (contracts, charters, confidentiality policy, etc.)

Don't forget to carry out an audit of your website. Because it constitutes the virtual showcase of your organization and therefore of your compliance with the GDPR. Website compliance is an essential point in your compliance process. This can be easily consulted by the CNIL, which can subsequently trigger an inspection. Website users are also increasingly sensitive to the protection of their data online. You must therefore be vigilant, an audit of the website may reveal compliance flaws which must be corrected.

In 2021, the CNIL carried out an awareness campaign on the audit of websites and mobile applications among organizations. This was focused on implementing its cookie recommendations. The audit turns out to be necessary to compare on the one hand what exists and what is applied in practice to on the other hand what is recommended and must be implemented.

Furthermore, the implementation of audits is also necessary in relationships “data controller /subcontractors”, to the extent that the latter participate in data processing on instructions and at the request of the data controller. If the subcontract is not yet concluded, consideration should be given to including a clause providing for a prior audit to assess the level of data protection conferred by the subcontractor. The contract may also provide for regular audits to monitor the evolution and proper application of protection measures by the subcontractor. If the contract has already been concluded it is not too late to carry out an audit.

In the event that the audit reveals that the subcontractor is not compliant, it is necessary to negotiate an amendment relating to the protection of personal data and/or, depending on the deviations observed, consider the termination clauses present in the initial contract. The data controller must ensure that throughout the duration of data processing, it is protected. Even processing carried out by a subcontractor must be subject to increased protection. The data controller must be vigilant on this point because his responsibility remains at stake, although all or part of the processing is delegated. It is therefore preferable for the data controller to carry out an audit, as he remains responsible for data security.

The response to the survey "Are audits mandatory according to the articles of the GDPR? "

During a survey carried out on January 5 on our LinkedIn page, we asked you if audits are mandatory according to the articles of the GDPR.

You were strong! Out of 183 voters, 41% of you voted "Yes and no, it is essential".

Indeed, no article of the GDPR concretely provides for the obligation to carry out audits to guarantee compliance. However, the audit remains a mandatory step to ensure compliance. It is also an essential tool for monitoring and updating your organization's compliance over time by carrying out regular audits, once a year for example.

Simply audit your business with Data Comply One (formerly Mission GDPR)

You don't know how to carry out your audit? Are you short on time? Is this too complex a practice for you?

With Data Comply One (formerly Mission RGPD) you can carry out your audits with ease! Respond to our audit templates, and the software recommends an action plan tailored to your responses. You can also create your own audit! In all cases, involve your employees but also your service providers and subcontractors directly in the platform. Data Comply One (formerly Mission RGPD) is practical and collaborative software that guides you in your compliance process.

Don't waste any more time, it's so simple!