SOX vs GDPR: which to pursue first, and whether you need both
If you are an SEC registrant with EU operations or EU customers, the question is usually sequencing, not choice. SOX is a legal duty if you are an SEC registrant in scope, because Section 404 requires management's annual assessment of internal control over financial reporting (ICFR) and, for accelerated and large accelerated filers that are not emerging growth companies, an auditor attestation. The GDPR applies on different grounds: it applies whenever you process personal data of people in the EEA, regardless of whether your shares are listed. For most companies in both groups, both regimes apply at once, and the practical decision is which program your team builds first and how the two share evidence.
Do not accept a 'GDPR certified' claim from a vendor or a peer as proof of compliance. The GDPR requires no audit, attestation or certificate. Certification under Article 42 is voluntary, is issued for at most three years by accredited bodies or supervisory authorities, and does not reduce the controller's or processor's responsibility. For SOX, the proof is management's ICFR assessment and the auditor's opinion. For the GDPR, the proof is documentation a supervisory authority can inspect, including your security measures under Article 32. Ask any certifying body which Article 42 scheme it operates and which supervisory authority recognizes it before you cite it to a customer or board.
Start with the SOX ITGCs that already support financial reporting, such as access and change controls on in-scope financial systems, because external auditors test them each year and the evidence is already expected. Then check whether those same controls cover the systems holding EU personal data. Where they do, record the overlap once and map it to Article 32 testing, rather than running two evidence cycles. Confirm the scope of both programs with your external auditor and with counsel or your data protection officer, since the boundary between financial reporting systems and personal data systems is set by your facts, not by either regulation.
How SOX and the GDPR differ on scope, proof and penalties
This table sets SOX Section 404 and the GDPR side by side on legal basis, scope, testing, proof and penalties. Read it as two different questions: whether financial reporting controls hold, and whether personal data processing is secured and lawful.
| Dimension | SOX (Section 404 and Section 906) | GDPR (Regulation (EU) 2016/679) |
|---|---|---|
| Legal basis | Sarbanes-Oxley Act of 2002, enacted July 30, 2002, with Section 404 management assessment and Rule 13a-15(c) evaluation | Regulation (EU) 2016/679, applied since 25 May 2018, binding and directly applicable in EU Member States and in EEA states under a 2018 Joint Committee Decision |
| Who is in scope | SEC registrants. Section 404(b) auditor attestation applies to accelerated and large accelerated filers that are not emerging growth companies | Controllers and processors handling personal data of individuals in the EU or EEA, wherever the organization is established, subject to the Regulation's territorial rules |
| What is protected | Reliability of financial reporting through internal control over financial reporting (ICFR) | Personal data and individuals' rights, including security of processing under Article 32 |
| Governing standard for testing | Management evaluates ICFR against a suitable framework such as COSO's 2013 framework. External auditors test under PCAOB AS 2201 and assess IT risk under AS 2110 | Article 32 requires measures appropriate to the risk. No prescribed control catalog or testing standard is set by the Regulation |
| Who tests or enforces | Management, the external auditor for accelerated filers, and the SEC. The CEO and CFO certify periodic reports under Section 906 | Independent national supervisory authorities (Article 51), with the European Data Protection Board resolving disputes (Articles 65 and 70) |
| Proof produced | Management's annual ICFR assessment and, where applicable, an auditor's attestation report on ICFR | No audit, attestation or certificate is required. Article 42 certification is voluntary, issued for at most three years, and does not reduce responsibility |
| Cycle | Annual, tied to each fiscal year end, with periodic reports certified by the CEO and CFO | Ongoing obligation with no fixed assessment cycle. Compliance is continuous, and breach notification runs under Articles 33 and 34 |
| Maximum penalties | Section 906 fines up to $1,000,000 and 10 years for knowing false certification, or up to $5,000,000 and 20 years for willful false certification. These attach to individuals, not to turnover | Article 83 maximums of EUR 10 million or 2% of total worldwide annual turnover, or EUR 20 million or 4%, whichever is higher, applied to the organization |
| Where ITGC evidence helps | Access and change controls over systems that feed financial reporting support the ICFR evaluation (Release 33-8810) | Access and change controls can support Article 32 confidentiality and integrity evidence. Confirm the mapping with counsel and your supervisory authority guidance |
Where ITGC access and change controls support Article 32
SOX ITGCs and GDPR Article 32 both ask for controlled access, managed change and resilient operations, but for different scopes and purposes. The overlap is real only where the same evidence is mapped deliberately to both, and that mapping is the company's own documented job.
Access control evidence
SEC Release 33-8810 names access to programs and data as an ITGC area management might consider. Article 32(1) asks for ongoing confidentiality, so the same user access reviews and privileged access logs can serve both ICFR and personal data protection. Check whether your access reviews cover systems that hold personal data, not only the ledger and its feeders. A CRM or support tool holding EU customer records may fall outside SOX scope but inside Article 32.
Change management evidence
Program changes are another ITGC area named in Release 33-8810. Documented approvals, testing and segregation of duties for changes to financial systems give auditors evidence of integrity. Article 32(1) lists integrity among the goals of security of processing. Confirm whether change tickets for non-financial systems that process personal data follow the same approval and rollback steps, since SOX testing will not reach them.
Computer operations and resilience
Computer operations controls, such as job scheduling, backup monitoring and incident handling for financial systems, relate to availability. Article 32(1) names availability, resilience and timely restoration after an incident as required outcomes. Restore tests run for ICFR may be reusable, but only if their scope, frequency and results are recorded against the personal data systems they cover. Ask who owns restore testing for systems outside the financial close.
Regular testing of effectiveness
Article 32(1) asks for a process of regularly testing, assessing and evaluating the effectiveness of security measures. ITGC testing performed by management and the external auditor produces a period-based record of control operation. That record is useful evidence, but it tests only the controls in SOX scope. A separate test plan covering the processing of personal data is still needed to show Article 32 testing.
Personal data systems outside financial reporting
Article 32 applies to any processing of personal data, including marketing platforms, HR tools, and customer analytics, even when none of them affects a financial statement line. SOX scope is set by financial reporting risk. Build an inventory of personal data systems from the GDPR records of processing, then compare it with the ITGC scope list. Systems in the gap need their own control owners and evidence.
Mapping is the company's job
No official mapping says a SOX control satisfies Article 32. ENISA states that its own mapping is not a measure of equivalence and does not assess whether a standard fully covers the regulation's requirements. Document each shared control, the Article 32 measure it supports, the evidence it produces and the gaps. Have legal counsel and your external auditor review the mapping before you rely on it in an assessment.
Who enforces each regime and what a regulator can do
SOX and the GDPR are enforced through different channels, and that split shapes what evidence you need. For SOX, the SEC writes the rules, management evaluates internal control over financial reporting (ICFR) each fiscal year end, and the external auditor tests it under PCAOB AS 2201 and assesses IT risk under AS 2110. The auditor, not a regulator, is the first party who examines your IT general controls, and a weakness there can lead to an adverse ICFR conclusion. For the GDPR, enforcement sits with independent national supervisory authorities under Article 51. The European Data Protection Board issues guidelines and, under Articles 65 and 70, can adopt binding decisions to resolve disputes between authorities. Ask counsel which supervisory authority would be lead authority for each EU establishment you operate, because that determines who you deal with in an investigation.
Regulation (EU) 2025/2518 adds procedural rules for complaints and investigations in cross-border GDPR cases and applies from 2 April 2027. Plan for it now if you run multi-country EU processing, since timelines and cooperation duties will change how you assemble evidence. The GDPR text had not been amended as of October 2026. The Omnibus IV proposal (procedure 2025/0130(COD)) had a text agreed in interinstitutional negotiations on 26 June 2026 and was awaiting Parliament's first-reading vote, and the Digital Omnibus proposal (procedure 2025/0360(COD)) was awaiting committee decision. Confirm the current status of both on the European Parliament Legislative Observatory) and with counsel before you rely on any provision.
The GDPR also applies in Iceland, Liechtenstein and Norway under an EEA Joint Committee Decision that entered into force on 20 July 2018, so EEA affiliates and data subjects there fall within the same supervisory framework. Confirm with counsel how that applies to each entity in your group. Under SOX, the practical question is different: confirm which of your filers are accelerated or large accelerated and whether the Section 404(b) auditor attestation applies, since that sets how much external testing your ITGC evidence must support.
Running both programs: order of work and shared evidence
This sequence moves from agreed scope to shared access and change evidence, then to Article 32 testing and incident rehearsal, so one set of records can answer the external auditor and the supervisory authority. The order depends on the audit calendar and on the EU exposure, but the first step is always scope agreed in writing.
Confirm regimes and in-scope systems in writing
Start by agreeing in writing which SOX Section 404 scope applies (the filer status and the financial reporting systems the external auditor will rely on) and which GDPR obligations apply (the EU establishments, EU data subjects and processing activities, including EEA members under the EEA Joint Committee Decision). Finance, legal, the data protection lead and IT sign the same list. Done means one register of in-scope systems exists, with each system tagged for financial reporting, personal data, or both.
Map ITGC areas to personal data systems
Take the systems tagged for both regimes and map them against the ITGC areas SEC Release 33-8810 names: program development, program changes, computer operations and access to programs and data. Record which systems hold personal data that also feeds financial reporting, such as payroll, billing and customer ledgers. Done means each shared system has a row showing its ITGC controls and the processing activities it supports, reviewed by the controller's privacy lead and the SOX control owner.
Assign one owner for shared access and change evidence
Name a single owner for access reviews and change records on shared systems, so user provisioning, privileged access and change approvals produce one evidence set. The owner should also confirm that access and change records can be tied to the GDPR records of processing. Ask the external auditor which population and sampling approach they will use before the evidence is collected. Done means a written evidence standard exists and the auditor has accepted the format in principle.
Close ITGC gaps before the auditor tests them
Run the ITGC cycle on the shared systems: design the controls, operate them for the period, and test whether they worked. Look for gaps in logical access reviews, segregation of duties, change approvals and backup and recovery of financial data. Record each deficiency, its owner and its remediation evidence. Done means the control matrix reflects the state of the systems the auditor will sample, with open items documented rather than hidden.
Document Article 32 measures and testing evidence
Document the security measures that the ITGC controls support under Article 32(1), including encryption, confidentiality, integrity, availability, resilience and restoration, and the regular testing of their effectiveness. Reuse ITGC test results where they cover the same control, and add GDPR-specific tests where they do not. Done means each Article 32 measure points to a control, a test and a dated result that the data protection lead can produce for a supervisory authority.
Rehearse breach and incident reporting paths
Walk through a tabletop scenario in which personal data and financial reporting systems are affected together. Test whether the GDPR breach notification path (Articles 33 and 34) and the internal escalation path for financial reporting impact can run in parallel, and who signs the SOX and GDPR decisions. Confirm the exact notification timing with counsel, because this page does not set a deadline. Done means a written playbook exists with named roles and a lessons-learned log that feeds the ITGC and Article 32 records.
What drives cost when you run SOX and GDPR together
In this model, a single internal owner, usually in IT risk or security governance, coordinates SOX ITGC testing and GDPR security-of-processing evidence under one control set. Your company pays internal salaries for that role and for the control operators who perform access reviews, change approvals and logging checks. The external auditor is paid by the company for the SOX Section 404 work, and the GDPR side has no audit fee because the regulation requires no audit or certificate. Much of the cost is recurring, since access reviews and change samples happen every fiscal year and data protection impact and processing records need upkeep.
- Who is paid: the company pays staff time and the external financial auditor, not a GDPR assessor.
- One-time costs: mapping ITGC controls to Article 32 measures and building the shared control matrix.
- Recurring costs: annual ITGC testing cycles, periodic access reviews and records maintenance.
- What raises effort: more in-scope systems, more processing activities, and separate ownership for each entity or region.
- What lowers effort: a single control matrix with one evidence owner per control.
Check whether your owner has the authority and time to cover both regimes, and ask what each role will do each quarter.
Here each regime keeps its own program and owner, but both draw from one evidence library: access review exports, change tickets, logging configurations and backup test records. SOX work stays with finance-facing IT controls and GDPR work stays with privacy and security teams. The cost comes from keeping the library accurate and from the duplicate reviews that arise when each team asks for the same screenshots. Savings come from avoiding duplicate collection, though the two programs still need their own sign-offs and their own findings tracking.
- Who is paid: the company pays two sets of staff time plus the SOX auditor; the GDPR side costs internal effort only.
- One-time costs: designing the evidence library, naming conventions and retention rules.
- Recurring costs: library upkeep, owner reviews and reconciling findings across both programs.
- What raises effort: inconsistent system inventories, manual exports and unclear evidence ownership.
- What lowers effort: automated evidence collection and one agreed system register.
Confirm with your auditor which artifacts they accept as direct evidence, since a shared item still needs to meet each program's own test.
An outside implementation partner can plan, build, document and verify parts of the combined program against a scope agreed in writing before work starts. DeployOpen works this way: it prepares systems, controls and evidence for compliance assessments but does not issue audit reports or attestations, which remain the job of the external auditor and supervisory authorities. Your company pays the partner for the agreed deliverables, and the quote follows from the written scope. Ongoing support and upgrades are separate retainers, so recurring cost depends on whether you buy them.
- Who is paid: the partner for defined work, the external auditor for SOX attestation, and internal staff for oversight.
- One-time costs: scoping, control design, Article 32 gap work and evidence set-up.
- Recurring costs: any retainer for testing, upgrades or continuous support, plus annual audit fees.
- What raises effort: a broad scope, legacy systems and a large number of in-scope applications.
- What lowers effort: a narrow first phase and a clear list of systems in scope.
Ask for deliverables, assumptions and exclusions in writing, and confirm how the attestation cost moves if your filer status changes. For reference, the SEC estimated in 2020 (Release 34-88365) that an issuer newly exempt from the Section 404(b) auditor attestation would save about $210,000 per year on average, roughly $110,000 in audit fees and $100,000 in other costs, which shows how attestation scope alone changes the budget.
Questions buyers ask before hiring outside help on SOX and GDPR
Do we need GDPR certification to sell in the EU?
No. The GDPR requires no audit, attestation or certificate. Article 42 certification is voluntary, issued for at most three years by accredited certification bodies or supervisory authorities, and it does not reduce the controller's or processor's responsibility for compliance. What you must be able to show is that processing meets the regulation's obligations, including security of processing under Article 32, breach notification under Articles 33 and 34, and the transfer rules in Chapter V. EU customers and procurement teams may still ask for evidence, so plan the documentation you can produce on request. Confirm with EU data protection counsel which obligations apply to your customer contracts and whether any sector rule adds a certification requirement for your business.
Does SOX cover personal data?
SOX does not set a personal data regime. Its IT general controls exist to support reliable financial reporting under Section 404, so the systems in scope are those that produce or feed the financial statements, such as the general ledger, ERP, payroll and the access and change processes around them. Those systems hold personal data, such as employee and customer records, so ITGC evidence about user access touches personal data indirectly. SOX does not regulate how that data is processed, retained or disclosed. SEC Release 33-8810 says management only needs to evaluate the ITGCs necessary for the proper operation of controls that address financial reporting risks. The two scopes overlap in systems, while their purposes differ. Confirm the system inventory with your external auditor and the processing map with privacy counsel.
How much effort does running both take and what drives it?
Effort depends mostly on how many systems sit in both scopes and how much control evidence the two programs can share. One-time work includes scoping, mapping ITGCs to the Article 32 measures, data mapping and documenting processing activities. Recurring work includes periodic control testing, access reviews, change sampling, auditor fees and privacy operations such as handling data subject requests. The SEC estimated in 2020 that an issuer newly exempt from the Section 404(b) auditor attestation would save about $210,000 per year on average, roughly $110,000 in audit fees and $100,000 in other costs (Release 34-88365). That figure shows how much auditor attestation alone can weigh, but it describes a different population, so do not use it as your budget. Drivers include the number of in-scope applications, EU data volume, processors and transfers, and how mature your evidence is. Ask any partner for a written scope that lists systems, controls, deliverables and who pays for each.
What do we need to provide internally?
Your staff must own the facts, decisions and sign-offs, because neither SOX nor the GDPR can be delegated to an outside party. Typical internal inputs include:
- A current application and system inventory, with a named owner for each financial close process and each personal data flow.
- Access and change records from your identity and ticketing tools, plus your records of processing activities and processor list.
- Management's ICFR assessment, which management signs under Rule 13a-15(c), and the CEO and CFO certifications required by Section 906 for periodic reports.
For the GDPR, the controller must be identifiable and accountable for its processing. Confirm with counsel whether a data protection officer is required for your organization. Ask any partner to list each internal input, its owner and the point in the engagement where it is needed.
Can our team do this without a partner?
Yes, many teams run both programs internally. The decision turns on capacity, skills and independence. SEC guidance requires management to evaluate ITGCs, and external auditors test ICFR under PCAOB AS 2201, so internal teams can own the evidence and testing while the auditor performs its own procedures. Nothing in the GDPR requires a particular firm to help. Internal ownership works best when someone can map Article 32 measures to existing controls, keep records current and explain the program to auditors and supervisory authorities. A partner adds value when you need a fixed-scope plan, extra hands for security testing or help preparing controls and evidence for an assessment. DeployOpen plans, implements, documents and supports self-hosted platforms and prepares controls and evidence for compliance assessments, but it does not issue audit reports or attestations. Ask a partner and your auditors what each will and will not sign.
How long does it take?
Duration depends on scope, and no single figure fits both programs. The length is set by how many systems and controls are in the SOX ITGC inventory, how many EU data flows and processors need mapping, how current your documentation is and whether any control testing already exists. Auditor timing follows your fiscal calendar, because Rule 13a-15(c) requires management to evaluate ICFR as of each fiscal year end. The GDPR has no assessment calendar, so your GDPR timeline depends on your own remediation plan and on any inquiry from a supervisory authority. Fixed-scope engagements have their timelines agreed in writing before work starts, so ask for milestones tied to your fiscal calendar and to the evidence each milestone produces. Confirm the audit window with your external auditor and remediation expectations with counsel.
Does passing a SOX audit prove GDPR compliance?
No. A SOX audit tests whether controls over financial reporting operated effectively, and the auditor's opinion covers ICFR, not the full processing of personal data under the GDPR. Clean ITGC testing is useful evidence for Article 32, because access control, change management and logging support confidentiality, integrity and availability, and Article 32 names regular testing of effectiveness. Article 32 also asks for measures appropriate to the risk, including pseudonymisation, encryption and timely restoration after an incident, which SOX testing does not cover. Breach notification under Articles 33 and 34, lawful basis, data subject rights and transfers under Chapter V sit outside ITGC scope. The GDPR offers no audit or certificate that could stand in for these. Confirm with your auditor exactly what the SOX opinion covers, and with counsel or your supervisory authority which GDPR obligations need separate evidence.
How DeployOpen prepares SOX and GDPR evidence
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For SOX vs GDPR work, we prepare the technology controls and evidence that each program can use, while the external auditor, the supervisory authority and the client's own legal counsel remain responsible for their respective conclusions.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- The written scope names the in-scope financial reporting systems, personal data processing activities and the IT general control areas management has chosen to evaluate.
- Scope also states what is excluded, such as operational-only controls or systems outside the client's infrastructure.
How we build
- We configure access, change and logging controls on self-hosted platforms so they can serve both ITGC testing and Article 32 security of processing.
- Control design is documented against the client's own risk assessment, not a generic template, and mapped to the evidence each auditor or regulator will request.
- Platform hardening, backup and restoration procedures are built and tested within the client's own cloud accounts, data centers or air-gapped networks.
How we hand over
- Deliverables include control descriptions, configuration records, runbooks and evidence collection procedures that the client's internal team can operate.
- Each control is linked to the SOX control objective or GDPR obligation it supports, so overlapping evidence is not duplicated across the two programs.
- DeployOpen prepares systems, controls and evidence for assessment. It does not issue audit reports, attestations or certifications, which independent auditors and certification bodies provide.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
- Retainers can cover control evidence refreshes after platform upgrades, so changes stay visible to the ITGC change management process.
- Ask for a written quote from a defined scope, and confirm with your auditor and data protection officer which evidence they will accept before work starts.
Sources and further reading
- 15 U.S.C. 7262, Management assessment of internal controls (SOX Section 404 as amended) ↗
- Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting, Release 33-8810 ↗
- Regulation (EU) 2016/679 (GDPR), EUR-Lex ↗
- Regulation (EU) 2025/2518 on additional procedural rules for GDPR enforcement, EUR-Lex ↗
- PCAOB Auditing Standard No. 5 (now AS 2201) as filed with the SEC ↗
- COSO Internal Control, Integrated Framework Principles (2013) ↗
