If your organization entrusts external providers, such as IT vendors, accounting firms or HR companies, with processing personal data, you are responsible for how that data is protected. Reviewing data processors is your obligation under Article 28 of the GDPR. Here is a practical procedure covering what to check, how to conduct an audit and what to do with the results.
What is a data processor audit?
A data processor audit is a process for checking whether the companies entrusted with personal data carry out their obligations under the GDPR and the data processing agreement. It is part of the accountability principle (Article 28 of the GDPR): you must be able to demonstrate that your oversight of processors works in practice.
What is a data processor audit for?
An audit procedure is part of data protection and helps you to:
- Meet your GDPR oversight obligation: as the data controller, you must check whether processors handle data lawfully.
- Verify safeguards: make sure the processor uses appropriate technical and organizational measures, such as encryption, access controls and backups.
- Check compliance with the data processing agreement: confirm that the processor acts within the agreed scope and follows the agreed procedures and safeguards.
- Identify problems early: find them before they become a personal data breach and lead to financial penalties.
- Demonstrate accountability: show the supervisory authority that you actively oversee the entities to which you entrust data.
- Protect your organization’s reputation: working with reliable processors reduces the risk of a data breach and loss of client trust.
Scope of a data processor audit
The audit should cover the following areas:
- Technical and organizational measures: which safeguards the processor uses, such as encryption, access controls and pseudonymization.
- Compliance with the data processing agreement: whether the processor processes data beyond the scope of the agreement.
- Data protection procedures: whether the processor has implemented policies and procedures related to personal data protection.
- Incident response: whether the processor has a procedure for reporting violations and how it applies that procedure in practice.
- Processing only on the controller’s instructions: whether the processor uses the data for its own purposes.
- Subprocessing: whether the processor engages further subcontractors and does so in accordance with the data processing agreement (the controller’s consent is required).
- Employee training: whether the processor’s staff have been trained in personal data protection.
How does the data processor audit process work?
Step 1: Prepare for the audit
- Appoint the people responsible for the audit.
- Define the audit scope and assessment criteria.
- Prepare a list of questions and documents you will request from the processor.
Step 2: Notify the processor
- Inform the processor about the planned audit, unless the data processing agreement provides for unannounced audits.
Step 3: Conduct the audit
- Documentation review: review agreements, policies and procedures related to data processing.
- On-site visit: check physical safeguards, IT systems and work organization.
- Employee interviews: speak with the people responsible for data processing to verify the practices they use.
- Tests and samples: analyze safeguards in IT systems if this is justified by the audit scope.
Step 4: Prepare the audit report
- Describe the audit results, identified noncompliance and areas that need improvement.
- Make recommendations to the processor, specifying corrective actions and deadlines.
Step 5: Monitor corrective actions
- The processor implements the recommendations in the report.
- Check whether the corrective actions were actually taken and completed.
Step 6: Conduct recurring audits
- Conduct audits regularly, for example once a year, and on an ad hoc basis if you suspect a violation.
What should you do with the audit results?
- Document the results: the audit report summarizes the activities, identified noncompliance and recommendations.
- Send recommendations to the processor: provide the report and required corrective actions with a specified completion deadline.
- Monitor implementation of the recommendations: check whether the processor has followed them.
- Update the data processing agreement: if the audit found gaps in the agreement, supplement it or renegotiate it.
- Decide whether to continue working together: if the processor does not implement recommendations or commits serious violations, consider terminating the agreement.
Why is failing to audit a real risk?
- Risk of financial penalties: failing to oversee processors is a breach of Article 28 of the GDPR. The supervisory authority may impose an administrative fine.
- Risk of a personal data breach: if the processor does not use appropriate safeguards, your clients’ data may be exposed.
- Risk to your reputation: an incident at the processor affects your organization because you are the data controller.
- Risk of failing to demonstrate accountability: if the Polish supervisory authority (UODO) audits you, you must show that you oversaw the processor. Without documentation, you have no evidence.
How can AI improve data processor audits?
AI-based tools can speed up and organize the process of auditing processors. Here are specific uses:
- Monitoring compliance with the agreement: AI continually analyzes whether the processor handles data beyond the agreed scope.
- Anomaly detection: AI systems identify unauthorized data access or unusual processing patterns that may indicate a violation.
- Automated audit reports: AI generates audit reports based on collected data, reducing documentation time.
- Real-time safeguards monitoring: AI analyzes the status of encryption, access controls and other technical safeguards used by the processor.
- Processor risk assessment: AI identifies processors at higher risk of a violation, helping you prioritize audits.
- GDPR compliance checks: AI automatically checks whether the processor’s activities meet data protection requirements.
- Faster audits: AI collects data from different sources and assesses the processor’s compliance, improving oversight efficiency.
Summary
As the data controller, you are responsible for auditing processors. The process includes planning and conducting an audit, reporting the results and monitoring corrective actions. Regular audits help identify problems before they become personal data breaches and financial penalties.
If your organization works with processors, check whether you have an audit procedure in place. If you do not, start by reviewing your data processing agreements and appointing the people responsible for oversight.
Q&A: Data processor audit procedure
Who implements the data processor audit procedure?
The company’s management board or a designated department, such as the Data Protection Officer (DPO) or the audit and compliance department.
Where should you keep the data processor audit procedure?
In a central document repository, a system for managing agreements and data protection policies, or as a paper copy in the appropriate department.
How should you make the data processor audit procedure available?
Through the internal intranet, document management system, email or training for employees who work with processors. Limit access to authorized people only.
Who should conduct data processor audits?
- Data Protection Officer (DPO): if one has been appointed, as the person responsible for overseeing compliance in personal data processing.
- Audit and compliance department: in larger organizations, this department is responsible for auditing processors.
- Designated data protection employees: team members appointed by the management board.
- External auditors: when specialist knowledge or an independent assessment is needed.
