Short Reads

Countdown 2 weeks until GDPR : Will periodic data protection audits be mandatory under the GDPR?

Stibbe - Will periodic data protection audits be mandatory under the G

Countdown 2 weeks until GDPR : Will periodic data protection audits be mandatory under the GDPR?

09.05.2018 EU law

Only 2 more weeks to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.

Will periodic data protection audits be mandatory under the GDPR?

Under Article 32.1.d of the GDPR, data controllers and data processors must implement appropriate technical and organizational measures to ensure a level of security that is appropriate for the risk and, among those measures, they must regularly test and evaluate the effectiveness of the measures adopted for ensuring security of files.

Having said this, the GDPR does not lay down specific procedures or a specific format for those review and evaluation tasks. Consequently, unless binding national regulations set forth otherwise, data controllers and data processors are not required to conduct a specific type of mandatory audit – as defined in national regulations adopted under Directive 95/46. On the contrary, the general rule would be that the data controller or processor has the discretion to define the procedures for review and evaluation, provided that those procedures ensure complete verification and assessment of risks connected with the security of files.

approach will differ if the data controller or processor has voluntarily adhered to a given code of conduct (which could define detailed procedures for testing and reviewing purposes) or if they are bound by national regulations that, being aligned with the GDPR anyway, impose specifically defined (and mandatory) audit procedures.

 

Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.

Team

Related news

17.05.2022 EU law
Digital Law Up(to)date: Art. 17 of directive 2019/790 is valid!

Articles - The CJEU validates the new liability regime for large online platforms organised by article 17 of the directive 2019/790 on copyright and related rights in the Digital Single Market. The action was brought by the Republic of Poland to annul a part of article 17 as it is contrary to the right to freedom of expression.

Read more

11.05.2022 NL law
De afweging van grondrechten in het kader van corona

Articles - COVID-19 heeft de maatschappij voor dilemma’s geplaatst bij de afweging van volksgezondheid en bescherming van kwetsbaren tegenover vrijheden van het individu. In Tijdschrift voor Arbeidsrecht in Context schetsen Frederiek Fernhout en Judica Krikke de onderliggende rechten en vrijheden die vastgelegd zijn in het Europese grondrechtenkader, de AVG en nationale arbeidswetgeving en bespreken zij hoe deze tegen elkaar moeten worden afgewogen in de context van coronamaatregelen.

Read more