Short Reads

Countdown 2 weeks until GDPR : Will periodic data protection audits be mandatory under the GDPR?

Stibbe - Will periodic data protection audits be mandatory under the G

Countdown 2 weeks until GDPR : Will periodic data protection audits be mandatory under the GDPR?

09.05.2018 EU law

Only 2 more weeks to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.

Will periodic data protection audits be mandatory under the GDPR?

Under Article 32.1.d of the GDPR, data controllers and data processors must implement appropriate technical and organizational measures to ensure a level of security that is appropriate for the risk and, among those measures, they must regularly test and evaluate the effectiveness of the measures adopted for ensuring security of files.

Having said this, the GDPR does not lay down specific procedures or a specific format for those review and evaluation tasks. Consequently, unless binding national regulations set forth otherwise, data controllers and data processors are not required to conduct a specific type of mandatory audit – as defined in national regulations adopted under Directive 95/46. On the contrary, the general rule would be that the data controller or processor has the discretion to define the procedures for review and evaluation, provided that those procedures ensure complete verification and assessment of risks connected with the security of files.

approach will differ if the data controller or processor has voluntarily adhered to a given code of conduct (which could define detailed procedures for testing and reviewing purposes) or if they are bound by national regulations that, being aligned with the GDPR anyway, impose specifically defined (and mandatory) audit procedures.

 

Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.

Team

Related news

27.03.2019 NL law
Ook WhatsApp- en sms-berichten op privételefoons vallen onder Wet openbaarheid van bestuur

Short Reads - De Afdeling bestuursrechtspraak van de Raad van State heeft in een uitspraak van 20 maart 2019 (ECLI:NL:RVS:2019:899) bevestigd dat ook WhatsApp- en sms-berichten onder de reikwijdte van de Wet openbaarheid van bestuur (Wob) vallen. Dat geldt niet alleen voor WhatsApp- en sms-berichten die staan op werktelefoons, maar ook voor berichten die staan op privételefoons van bestuurders of ambtenaren. Daarmee gaat de Afdeling terecht verder dan de rechtbank (ECLI:NL:RBMNE:2017:5979) in eerste aanleg, die van oordeel was dat de Wob niet van toepassing is op berichten op privételefoons.

Read more

21.03.2019 NL law
15 aspects of Brexit you did not know

Short Reads - A Brexit without a deal, or with a deal that does not cover all relevant aspects, is still a potential scenario. We have highlighted a number of unexpected legal consequences of Brexit in such a no deal or incomplete deal scenario.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring