GDPR Audit Application
Data Protection

Lawfulness, fairness and transparency of processing. Purpose limitation. Data minimization. Accuracy and keeping data up to date. Storage limitation. Integrity and confidentiality. The data controller must be able to demonstrate compliance with these principles (accountability principle).

Mandatory when processing is likely to result in a high risk to the rights and freedoms of individuals (Article 35). Examples: systematic profiling, large-scale processing of sensitive data, systematic monitoring of publicly accessible areas. Supervisory authorities publish lists of processing operations requiring a DPIA.

Inform and advise the data controller, monitor internal GDPR compliance, advise on DPIAs, cooperate with the supervisory authority, serve as the point of contact for data subjects. The DPO must be independent, cannot be penalized for performing their duties, and must have sufficient resources.

Two levels of administrative fines: up to 10 million euros or 2% of global turnover (technical/organizational shortcomings), or up to 20 million euros or 4% of global turnover (violation of fundamental principles, data subject rights, transfers outside the EU). Supervisory authorities across Europe have issued fines reaching hundreds of millions of euros.

Maintain the processing register (Article 30), document completed impact assessments, retain proof of consent, formalize contracts with processors (Article 28), document data subject rights management procedures, maintain a data breach register, and retain privacy and security policies.