Short Reads

Countdown 2 weeks until GDPR : Will periodic data protection audits be mandatory under the GDPR?

Stibbe - Will periodic data protection audits be mandatory under the G

Countdown 2 weeks until GDPR : Will periodic data protection audits be mandatory under the GDPR?

09.05.2018 EU law

Only 2 more weeks to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.

Will periodic data protection audits be mandatory under the GDPR?

Under Article 32.1.d of the GDPR, data controllers and data processors must implement appropriate technical and organizational measures to ensure a level of security that is appropriate for the risk and, among those measures, they must regularly test and evaluate the effectiveness of the measures adopted for ensuring security of files.

Having said this, the GDPR does not lay down specific procedures or a specific format for those review and evaluation tasks. Consequently, unless binding national regulations set forth otherwise, data controllers and data processors are not required to conduct a specific type of mandatory audit – as defined in national regulations adopted under Directive 95/46. On the contrary, the general rule would be that the data controller or processor has the discretion to define the procedures for review and evaluation, provided that those procedures ensure complete verification and assessment of risks connected with the security of files.

approach will differ if the data controller or processor has voluntarily adhered to a given code of conduct (which could define detailed procedures for testing and reviewing purposes) or if they are bound by national regulations that, being aligned with the GDPR anyway, impose specifically defined (and mandatory) audit procedures.

 

Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.

Team

Related news

14.10.2019 NL law
Kamerdebat over digitalisering van de overheid: aandacht voor bescherming burger vereist

Short Reads - Op 24 september 2019 zijn er vier moties in stemming gebracht én aangenomen door de Tweede Kamer. De moties hebben als gemeenschappelijke deler dat ze in het teken staan van de steeds groter wordende digitalisering bij de overheid. Het achterliggende doel van de moties is dat de burger voldoende beschermd moet worden tegen deze digitalisering.

Read more

02.10.2019 EU law
Seminar: Data protection implications of (a no-deal) Brexit

Seminar - On October 25th at 9.30 am, we organize a seminar where we will discus the implications of a (no-deal) Brexit on data protection.  These issues affect all businesses interacting between UK and EEA (including EU) and which send or receive data to and from UK. We will highlight the main challenges both in the case of a hard Brexit on 31 October 2019 and in other scenarios. We will also offer guidelines to help your organisation mitigate the respective risks.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring