GDPR audit: internal reviews and regulator audits explained

What a GDPR audit is when the law requires none

The GDPR mandates no audit, attestation or certificate, so no regulator will ask for a particular report. The obligation is different and harder to dodge: under Article 5(2) and Article 24(1), the controller must implement appropriate technical and organisational measures and be able to demonstrate compliance. When a customer or board asks for proof, an internal or external audit is the usual way to produce that proof, because it tests the controls against the organization's own policies and records what was found and fixed. Articles 28(3)(h) and 58(1) also show where audits come from in practice: processors must allow the controller to audit them, and supervisory authorities may carry out data protection audits themselves.

Responsibility stays where the law puts it. The organization owns its controls, its records of processing and its decisions about risk. An implementation partner such as DeployOpen can prepare systems, access logging, documentation and evidence packs for an assessment, but it does not judge the organization's own compliance. Only an independent auditor or an accredited certification body issues a report or certificate. Voluntary certification under Article 42 is a separate route, and the EDPB register of certification mechanisms, seals and marks is the place to check which schemes exist before committing to one.

Cost and effort depend on scope, the systems in play and how mature the evidence already is. A review limited to one customer-facing application with current records costs far less than a review covering several hosting environments, sub-processors and years of undocumented changes. Before requesting a quote, confirm which processing activities are in scope, which systems hold personal data, whether DPIAs and the record of processing are current, and who will own the action plan after the review. Ask for the scope, deliverables and assumptions in writing, and separate one-time preparation from any recurring monitoring.

Which audit route answers which question

A GDPR audit is not one event. Four parallel routes check different parts of the same obligation, each run by a different party and producing different evidence. The fifth option, Article 42 certification, is external and voluntary, and it never replaces the other four.

DPO monitoring under Article 39

The data protection officer's minimum tasks include monitoring compliance with the GDPR and the organization's policies, including assignment of responsibilities, awareness, training and related audits. The DPO runs this route, which tests whether policies, roles and training actually operate. Evidence is the DPO's monitoring plan, findings log and advice records. Check that the DPO reports to the highest management level and has the time and access to do this work, whether the DPO is an employee or an outsourced service.

Periodic internal security audits

The EDPB small business guide recommends periodic security audits, each producing an action plan whose implementation is monitored at the highest level of the organization. The internal team or an independent reviewer runs them against the risk register and the security measures in place. Evidence includes audit reports, dated action plans, closure records and an updated risk management spreadsheet. Confirm who owns each action item and how overdue items escalate.

Processor audits under Article 28

Under Article 28(3)(h), a processor must make available the information needed to demonstrate compliance and must allow and contribute to audits, including inspections, by the controller or an auditor the controller mandates. The controller runs or commissions this route over its vendors and hosting providers. Evidence includes the processor's questionnaire answers, inspection notes, sub-processor lists and remediation commitments. Check that the processing contract grants audit rights in practice, not only on paper.

Supervisory authority audit powers

Under Article 58(1), a supervisory authority may order any information it requires, carry out data protection audits, and obtain access to all personal data and premises, including processing equipment. The authority runs this route, and the organization has no say over its timing or scope. Evidence the authority may request includes records of processing, DPIAs, breach logs and security documentation. Cooperation during an audit is a factor in deciding fines under Article 83(2)(f), so readiness matters.

Article 42 certification as the external option

Certification is the only external route, and it is voluntary. An accredited certification body or supervisory authority issues it for at most three years after a transparent process. It does not reduce the controller's or processor's responsibility, and it does not limit the regulator's powers. Ask which mechanism and which body issued it, and whether the scope covers the processing you actually run.

How DPO monitoring and periodic security audits work together

The data protection officer's monitoring role and the organization's periodic security audits are two different activities that feed each other. Under Article 39(1)(b), one of the DPO's minimum tasks is monitoring compliance with the GDPR and with the organization's data protection policies. That monitoring covers who is assigned which responsibilities, awareness-raising, staff training and the related audits. The DPO checks whether the audits happen, whether their findings are recorded, and whether the controls the organization has declared actually operate. The DPO does not perform the security controls, configure the systems or own the risk decisions. Those stay with the controller, which must be able to demonstrate compliance under Article 24(1). A reader should be able to point to a named manager for each control, and a DPO who finds a gap reports it and advises on the fix without taking over the work.

The EDPB's guide for small business recommends periodic security audits, with each audit producing an action plan. The guide expects the implementation of that action plan to be monitored at the highest level of the organization, so the board or senior management sees open items, owners and due dates rather than learning of them later. A regularly updated risk management spreadsheet, or a risk register held in an open-source GRC tool, is a practical place to record each finding, its risk rating, the mitigating control, the owner and the status. Before relying on any tool, confirm that it keeps dated history of changes, because an assessor or supervisory authority will ask when a finding was raised, when it was closed and who approved the closure.

For a working arrangement, agree in writing who prepares the audit plan, who signs off the action plan, how often the DPO reports to senior management and what evidence the DPO reviews at each check. A useful test is whether a sample of closed findings can be traced to a changed system, a updated procedure or a completed training record. If a finding stays open across several reporting cycles, the DPO should record the escalation and the senior decision, since the cooperation and remediation shown to a supervisory authority can influence fines under Article 83(2)(f). Organizations that outsource the DPO role should confirm that the external DPO has the same access to audit records and governance reports, and that the contract keeps accountability with the organization.

What processors and regulators can inspect

Article 28(3)(h) requires a processor to make available all information necessary to demonstrate compliance with the processor obligations, and to allow for and contribute to audits, including inspections, conducted by the controller or by an auditor the controller mandates. The right is not a standalone audit program. It becomes real only when the processing agreement sets out how the controller will exercise it, what information the processor will produce and how access to its systems and staff is arranged. The controller owns this obligation, so it must be able to show that it used the right or had a reasoned basis for not doing so.

Information first: Expect questionnaires, security documentation, policies, sub-processor lists and recent test results before any on-site or remote inspection.
Inspections and audits: The controller or its mandated auditor may inspect facilities, configurations and logs, subject to the contract's notice and confidentiality terms.
Sub-processor flow-down: The processor should pass comparable information and audit rights to its own sub-processors, and the controller should be able to see that this happened.
Mandated auditors: An independent auditor engaged by the controller must be bound by confidentiality and must not be a competitor of the processor.
Remediation tracking: Findings should produce a dated action plan that the controller follows through to closure.

Check whether your processing agreements name the information, notice periods and audit mechanics in writing, and whether you have ever exercised them.

How a GDPR internal audit runs from scope to action plan

The sequence turns a broad question about GDPR compliance into a scoped test of named processing activities, a written list of findings, and an action plan whose implementation is tracked to closure by the people who own the risk.

Agree scope and processing activities
The DPO or the audit lead agrees with the business owners which processing activities, systems, vendors and locations are in scope, and which controls are being tested. Each in-scope activity is named against the record of processing so that the test has a clear boundary. Scope is written down and approved by the owner of the compliance program, since an audit that cannot be bounded cannot be finished. The output is a signed scope note listing activities, systems, processors and the period covered.
Collect records, policies and existing evidence
The audit team gathers the documents the controller already holds, including the record of processing, privacy notices, retention schedules, DPIAs, processor contracts, access reviews, incident logs and training records. It checks that each document is current and matches what systems actually do, because a policy that describes a process no one follows is a finding in its own right. Gaps in the document set are logged at this stage rather than filled in by the auditor. The output is an evidence inventory mapped to each in-scope control.
Test controls against evidence
Testers compare each control with the evidence that should show it operating. They sample tickets, configuration exports, access lists, backup restore logs and request-handling records, and they check whether the control works as written across the period under review. Where a control depends on a processor, the audit asks what the processor contract and the processor's own evidence say. The output is a test record per control showing the procedure, the sample, the result and the tester's name.
Record findings with evidence and risk
Each exception is written up as a finding that states the requirement, what was tested, what was observed, the evidence reference and the risk to individuals if the gap stays open. Findings are rated consistently so that the most serious gaps, such as missing processor terms or untested restores, reach senior management first. The business owner reviews each finding for factual accuracy before it is finalized. The output is a findings register that the DPO can share with the accountable executive.
Agree the action plan with owners and dates
For every accepted finding, the control owner agrees a remediation action, a named person responsible, and a target date. The DPO records any finding the business chooses to accept, with the reason and the approver, so that risk acceptance is visible and not silent. The EDPB guidance for small organizations expects each audit to produce an action plan, and the plan should be approved at a level that can allocate budget. The output is a signed action plan with owners, dates and accepted risks.
Monitor implementation to closure
The DPO or audit lead tracks each action until the owner provides evidence that the fix works, and the auditor who tested the original control, or another reviewer, verifies that evidence before the finding is closed. Overdue items are escalated to the level that approved the plan, consistent with the EDPB expectation that implementation is monitored at the highest level of the organization. Open items feed the next audit scope. The output is a closed findings register and a status report to management.

What must be in place before an audit starts

Whatever form an audit takes, an internal review, a DPO monitoring cycle or a regulator inquiry, the same six items decide how quickly it goes. Each one shows the organization can demonstrate compliance, which Article 5(2) and Article 24(1) require, and each can be checked in an afternoon before the audit starts.

Record of processing

The record of processing lists each purpose, category of data subjects, categories of personal data, recipients, transfers to third countries and retention periods, as Article 30 describes. It is the first document a supervisory authority asks for and the map every other check depends on. To check it, pick three systems that hold personal data and confirm each appears in the record with a current owner and a retention period.

Current risk register

A risk register records each threat to personal data, its likelihood and impact, the controls that address it and the residual risk the organization accepts. The EDPB's small business guide suggests keeping a risk management spreadsheet and updating it regularly. To check it, confirm the last review date falls within the review cycle the organization has set and that every high-risk processing activity has a row.

Written security policies

Written policies state what staff and systems must do for access control, backup, logging, incident handling and data retention, and they show management has approved those rules. Article 24(2) expects policies where they are proportionate to the processing. To check them, confirm each policy names an approver, a version and a review date, and that the controls described in the policy exist in the systems.

Named owner for each control

Every control needs one accountable person who can explain it, show its evidence and fix it when it fails. Without a named owner, findings from an audit tend to stall between IT, legal and the business. To check this, pick five controls at random and confirm each has a single owner who can answer questions about it without referring the auditor elsewhere.

Processor contracts with audit clauses

Article 28(3)(h) requires a processor to make available the information needed to demonstrate compliance and to allow and contribute to audits, including inspections, by the controller or an auditor it mandates. A contract without this clause leaves the controller unable to test its processors on request. To check it, confirm every processor agreement contains an audit and inspection clause and that the sub-processor list is current.

Evidence folder per control

An evidence folder holds the artifacts that prove a control operates: configuration exports, access review sign-offs, training records, test results and incident logs, each dated and tied to the control it supports. Supervisory authorities can order any information they require under Article 58(1), so the folder should be ready before a request arrives. To check it, choose one control and confirm the folder shows evidence from at least two dates in the last review period.

Choosing between internal review, processor audit and certification

This table compares three ways to test GDPR compliance: an internal periodic audit, a controller's audit of a processor, and voluntary Article 42 certification. Read each row against your own purpose, since only the first two are routinely needed and the third is optional and does not transfer responsibility.

Option	Who performs it and what it proves	When it fits
Internal periodic audit	The organization's own staff or DPO check controls, policies and training against the GDPR and the EDPB small business guidance. It shows the organization is monitoring its own compliance, with findings tracked to an action plan.	Routine assurance for every controller and processor, and the default evidence of accountability under Article 5(2) and Article 24(1).
Processor audit by the controller	The controller, or an auditor it mandates, reviews a processor under Article 28(3)(h). It shows the processor has the information and cooperation needed to demonstrate its own compliance.	Before signing a processor contract, after material change in sub-processors or hosting, and when a customer or regulator asks for proof.
Article 42 certification	An accredited certification body or supervisory authority assesses the processing against approved criteria. It is voluntary, valid for at most three years, and does not reduce the controller's or processor's responsibility.	When a customer, tender or policy specifically asks for a certificate, or when the organization wants an independent scheme to rely on.
Who is the independent party	Internal review has no independent issuer. Processor audits are carried out by the controller or its mandated auditor. Certification is issued only by a body or authority, not by an implementation partner.	Confirm with the scheme owner and the certification body which party issues the outcome you need.
Regulator audit powers	Supervisory authorities may carry out data protection audits and access premises and personal data under Article 58(1). Cooperation during such work is a factor in fines under Article 83(2)(f).	Applies to every controller and processor, whether or not any voluntary audit or certificate exists.
Registered schemes	The EDPB register lists 17 entries as of October 2026, including European Data Protection Seals such as Europrivacy, EuroPriSe and BC 5701:2024, plus national schemes in France, Austria and Germany.	Check that a scheme's scope matches your processing and that its certifying body is accredited for it before relying on it.
Ask before buying	Ask who the auditor is, what criteria are tested, what evidence is produced, and how the findings and action plan are followed up.	Put these questions in the written scope before any assessment or certification work starts.

Who owns the audit, who prepares evidence and who certifies

Your organization owns the controls, the accountability and the action plan. Under Article 5(2) and Article 24(1), the controller must implement appropriate technical and organisational measures and be able to demonstrate compliance, and no vendor or consultant can discharge that duty for you. Your DPO, security lead and process owners run the internal reviews, decide what gets fixed and track each finding to closure.

Control ownership: Named owners for each measure, such as access control, logging or retention, who approve the design and accept residual risk.
Internal audit: Periodic reviews run by the DPO or a function independent of the team being checked, as the EDPB small business guide recommends for periodic security audits.
Action plan: A written plan from each audit, with owners, dates and status reported at the highest level of management.
DPO monitoring: Under Article 39(1)(b), the DPO monitors compliance, staff training and related audits, but does not carry out the controls.
Regulator contact: Your organization answers supervisory authority information requests and audit powers under Article 58(1), with cooperation weighed under Article 83(2)(f).

Confirm that each control has a named owner who can produce its evidence on request.",

How to choose an auditor or consultant for GDPR

The GDPR requires no audit, so any outside review is a choice you make. The cards below cover the checks that separate a credible reviewer from a sales pitch, and the questions to settle before any written scope is signed.

Confirm accreditation for certification work

If you want a certificate under Article 42, the body issuing it must be accredited. Check the EDPB register of certification mechanisms, seals and marks, and confirm accreditation with the national accreditation body or the supervisory authority that approved the scheme. An internal review or readiness assessment needs no accreditation, so do not let a consultant imply that it does. Ask which scheme and which criteria version apply to the work.

Separate the reviewer from the work audited

A reviewer who designed your controls, or who acts as your DPO, cannot also judge them independently. Ask whether the firm has built, run or operated any system in scope, and whether the same people will report on it. Where your DPO is an external service, check that the DPO's monitoring role under Article 39 is not compromised by a second contract to deliver the fixes.

Test sector and processing experience

A review of an HR platform, a clinical system and an ad tech pipeline raises different risks under Article 32 and different transfer questions under Chapter V. Ask for examples of the processing types you run, including special category data, cross-border hosting and processor chains. Ask how they would sample records, logs and sub-processor contracts, and what they would not cover.

Require a written fixed scope

Agree in writing the systems, processing activities, sites, time period, sampling method and deliverables before work starts. The scope should name what the reviewer will not test, such as an external penetration test or a legal opinion on lawful basis. Most engagements are fixed-scope; a vague scope leads to disputes about what was covered and to findings that cannot be closed.

Ask who signs and how evidence is kept

Ask who signs the report, who is accountable for its conclusions, and whether the signer holds the qualification the firm claims. Confirm who owns the evidence files, how long they are retained, where they are stored, and whether you receive copies at close. A consultant may prepare findings, but only the controller owns its compliance position, and an independent auditor or certification body issues any formal opinion or certificate.

Confirm the action plan follows the review

The EDPB's guidance for small organizations expects each periodic security audit to produce an action plan whose implementation is monitored at the highest level of the organization. Ask how findings are ranked, who owns each action, how progress is reported to management, and whether the firm will re-test closed items. Where a supervisory authority is involved, cooperation under Article 83(2)(f) is weighed in deciding fines, so keep the review record complete.

GDPR audit questions buyers ask

Does the GDPR require an audit?

No. The GDPR does not require an audit, attestation or certificate, and it does not create a registration step that an auditor must sign off. What it requires is that the controller implements appropriate technical and organisational measures and can demonstrate compliance, which is set out in Article 5(2) and Article 24(1). That demonstration is what a supervisory authority will ask for, and the evidence you keep, such as records of processing, risk assessments, test results and action plans, is what shows it. Whether you commission an external review is your choice, driven by your risk, your contracts and your internal capacity.

Is GDPR certification required, and what does it add?

No. Certification under Article 42 is voluntary, issued for at most three years by accredited certification bodies or supervisory authorities, and it is not mandatory for any organization. A certificate does not reduce your responsibility for compliance or the powers of supervisory authorities, as Article 42(4) makes clear. Its value is mainly as an external signal to customers and partners, and as a structured way to test your controls against published criteria. The EDPB register of certification mechanisms, seals and marks lists the schemes currently available, so check which one fits your processing and whether it is accredited for your sector.

How long does a GDPR audit take, and what drives the effort?

The duration depends on the scope, not on a fixed period that applies to every organization. The main drivers are the number of systems and processing activities in scope, how well your records of processing and data flows are already documented, how many processors and sub-processors you rely on, and whether you need to test technical controls or only review policies. A review of a single system with current documentation will take far less effort than a review across a multi-country estate with undocumented data flows. Ask any provider to state the scope, the systems tested and the deliverables in writing before agreeing a timeline, since no fixed duration is set by the GDPR itself.

Can our DPO run the GDPR audit?

The DPO can monitor compliance, but the controller owns the outcome. Article 39(1)(b) lists monitoring compliance, including related audits, among the DPO's minimum tasks, and the DPO should advise on and check the programme. However, the controller must still implement the measures, act on the findings and be able to demonstrate compliance under Article 24. Where the DPO is also responsible for running technical testing, independence can become a problem, so many organizations keep the DPO as the monitoring function and bring in a separate team to carry out security testing and document the results. If you use an outsourced DPO, confirm in the contract who prepares the evidence and who decides on remediation.

What does the internal team need to provide for a review?

The internal team provides the knowledge that outsiders cannot easily reconstruct, and the access needed to verify it. In practice this means:

A current inventory of systems, data stores and processing activities, with the owners named for each.
Access to configuration, logs, access reviews, backup records and incident records for the systems in scope.
Named contacts in IT, security, HR and the business units who can explain how personal data moves and who uses it.
Time to review findings, agree an action plan and assign owners for each action, since the EDPB's small business guidance expects implementation to be monitored at the highest level of the organization.

If these inputs are missing, expect the effort to rise, because discovery work will fall on whoever runs the review.

Can a processor be audited by its customers?

Yes. Under Article 28(3)(h), a processor must make available all information needed to demonstrate compliance and must allow and contribute to audits, including inspections, by the controller or an auditor the controller mandates. This is usually written into the processing agreement, and it is the reason customers ask software and service providers for evidence before signing. If you are the processor, expect requests for security documentation, sub-processor lists and test results, and set limits on scope and frequency in the contract. If you are the controller, confirm what evidence your processors can provide before relying on it.

What powers does a supervisory authority have in an audit?

Supervisory authorities have broad investigative powers under Article 58(1). They can order you to provide any information they require, carry out data protection audits, and obtain access to all personal data and to premises, including processing equipment. Your cooperation during such an inquiry is a factor in deciding any fine under Article 83(2)(f), so being able to produce records quickly matters. Keep evidence in a form that can be exported on request, and make sure your staff know who handles regulator contact. A supervisory authority's audit is not the same as a voluntary review you commission, and your internal records should be designed to answer a regulator's questions directly.

How DeployOpen prepares your systems and evidence for a GDPR audit

DeployOpen scopes this work in writing before it starts. The agreed scope names the systems, processors, data flows and controls to be reviewed, the evidence each review must produce and the deliverables. For a GDPR audit programme, that usually means the access control configuration, logging and retention settings, backup and restore records, and the processing records that feed your periodic reviews. DeployOpen implements and hardens self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, so the configuration evidence sits where your DPO and security team can inspect it. The organization still owns every control, its risk decisions and its audit action plan.

Where agreed, DeployOpen also prepares control evidence and runs security testing against the systems in scope, such as application, API and infrastructure testing. Results go into a documented remediation list that your team assigns and tracks. Before the engagement closes, DeployOpen hands over the configuration baselines, test reports, runbooks and an evidence index mapped to the scope. Confirm with your DPO which format they need for monitoring records, and whether the evidence must be retained for a fixed period under your own policy. Ask for those formats in the written scope, not after delivery.

DeployOpen does not issue audit reports, attestations or certificates, and it does not act as your DPO, EU representative or certification body. Only an independent auditor, assessor or accredited certification body can issue a report or certificate, and the GDPR does not require one. DeployOpen cannot guarantee that a supervisory authority, auditor or certification body will reach any particular conclusion. Its role is to make your systems and evidence ready for the review you choose to carry out, and to make the gaps visible early enough to fix them.

GDPR audit: internal reviews, DPO monitoring and regulator audits