What is a Data Protection Audit?
A data protection audit is a systematic review of your organization's data protection situation. It shows you where you are GDPR-compliant — and where you are not. The result is a written report with concrete, prioritized measures.
An audit is not an end in itself: it protects you from fines, strengthens your customers' trust, and creates planning certainty.
What we examine
Legal bases
- Does a lawful basis exist for every processing activity (Art. 6 GDPR)?
- Are consents correctly obtained and documented?
- Are special categories of data (Art. 9 GDPR) handled correctly?
Documentation
- Is the Records of Processing Activities complete and up to date?
- Are DPAs concluded with all processors?
- Are technical and organizational measures documented?
Website and online presence
- Is the privacy notice complete and up to date?
- Are cookies and tracking services used correctly?
- Are external services (e.g. Google Fonts, YouTube) embedded in a GDPR-compliant way?
Organizational measures
- Are employees trained and bound to confidentiality?
- Is there a process for data breaches and data subject requests?
- Is IT security adequate (access permissions, password policies)?
How the audit proceeds
- Questionnaire — an upfront self-assessment of your organization
- Analysis — review of your documents and systems (remote possible)
- Audit report — written assessment with gaps and recommendations
- Discussion — joint review of the results
- Action plan — prioritized plan with timelines
When is an audit worthwhile?
- Before building a data protection management system for the first time
- After a long period without a structured review
- After introducing new software or processes
- As preparation for a supervisory authority inspection
- As evidence for customers or partners