The General Data Protection Regulation (GDPR) is a regulation that came into force on 25th May 2018. It applies to all organisations that process personal data of individuals residing in the European Union (EU), including the United Kingdom (UK). The GDPR sets out a framework for data protection, including the rights of individuals and the obligations of organisations. Failure to comply with the GDPR can result in significant fines and reputational damage. Therefore, organisations need to audit their compliance with the GDPR regularly. This article explores how to audit for GDPR compliance in the UK.

Understanding the GDPR Requirements

Before conducting an audit, it is crucial to understand the requirements of the GDPR. At the heart of the GDPR are seven principles organisations must follow when processing personal data. These principles are:

• Lawfulness, Fairness and Transparency
• Purpose Limitation
• Data Minimisation
• Accuracy
• Storage Limitation
• Integrity and Confidentiality (Security)
• Accountability

In addition to these principles, the GDPR gives individuals certain rights regarding their personal data. These rights include:

• Right to be Informed
• Right to Access
• Right to Rectification
• Right to Erasure
• Right to Restrict Processing
• Right to Data Portability
• Right to Object
• Right to Object to Automated Profiling

Conducting a GDPR Compliance Audit

The following is a step-by-step guide on how to audit for GDPR compliance:

Step 1: Identify the Data Processed

The first step in a GDPR compliance audit is to identify the personal data processed by the organisation. This includes data held in electronic and paper formats. Organisations must know what personal data they hold, where it came from, and who it is shared with.

Step 2: Assess GDPR Compliance

The second step is to assess the organisation’s compliance with the GDPR. This involves reviewing policies, procedures, and processes to ensure they meet the GDPR’s requirements. For example, organisations must have a lawful basis for processing personal data, obtain explicit consent where required, and implement appropriate technical and organisational measures to ensure data security.

Step 3: Review Data Protection Impact Assessments

The GDPR requires organisations to carry out a Data Protection Impact Assessment (DPIA) where processing will likely result in a high risk to individuals’ rights and freedoms. The third step in a GDPR compliance audit is to review DPIAs for completeness and accuracy.

Step 4: Evaluate Data Subject Rights

The GDPR gives individuals certain rights regarding their personal data. The fourth step in a GDPR compliance audit is to evaluate whether the organisation is fulfilling these rights. For example, individuals can access their personal data and have it rectified or erased where necessary.

Step 5: Review Data Breach Procedures

The GDPR requires organisations to report certain personal data breaches to the relevant supervisory authority within 72 hours of becoming aware of the breach. The fifth step in a GDPR compliance audit is to review data breach procedures to ensure they meet the GDPR’s requirements.

Step 6: Assess Third-Party Compliance

Organisations must ensure that third-party processors they engage comply with the GDPR’s requirements. The sixth step in a GDPR compliance audit is to assess third-party compliance. This includes reviewing contracts with third-party processors to ensure they include the necessary GDPR provisions.

Step 7: Document the Audit

The final step in a GDPR compliance audit is to document the findings. This includes identifying areas of non-compliance and making recommendations for improvement. Organisations should also document any remedial action taken.

Conclusion

Auditing for GDPR compliance is essential for organisations operating in the UK. Failure to comply with the GDPR can result in significant fines and reputational damage. By following the steps outlined in this article, organisations can ensure they are meeting the GDPR’s requirements and protecting the rights of individuals. It is recommended that organisations conduct regular GDPR compliance audits to ensure ongoing compliance.

Briefed is a team of barristers that provide legal advice to businesses to ensure compliance with existing regulations and laws. Our barristers are highly experienced in helping companies stay compliant and achieve their business objectives. We provide guidance and support in all areas of regulation, including GDPR legal compliance. Contact us to find out how we can help!