Short Reads

Countdown 2 weeks until GDPR : Will periodic data protection audits be mandatory under the GDPR?

Stibbe - Will periodic data protection audits be mandatory under the G

Countdown 2 weeks until GDPR : Will periodic data protection audits be mandatory under the GDPR?

09.05.2018 EU law

Only 2 more weeks to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.

Will periodic data protection audits be mandatory under the GDPR?

Under Article 32.1.d of the GDPR, data controllers and data processors must implement appropriate technical and organizational measures to ensure a level of security that is appropriate for the risk and, among those measures, they must regularly test and evaluate the effectiveness of the measures adopted for ensuring security of files.

Having said this, the GDPR does not lay down specific procedures or a specific format for those review and evaluation tasks. Consequently, unless binding national regulations set forth otherwise, data controllers and data processors are not required to conduct a specific type of mandatory audit – as defined in national regulations adopted under Directive 95/46. On the contrary, the general rule would be that the data controller or processor has the discretion to define the procedures for review and evaluation, provided that those procedures ensure complete verification and assessment of risks connected with the security of files.

approach will differ if the data controller or processor has voluntarily adhered to a given code of conduct (which could define detailed procedures for testing and reviewing purposes) or if they are bound by national regulations that, being aligned with the GDPR anyway, impose specifically defined (and mandatory) audit procedures.

 

Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.

Team

Related news

21.10.2021 EU law
Law and Artificial Intelligence (part three): towards a European perspective in intellectual property? The European Parliament goes one step further…

Articles - For the European Union, it is time to have uniformed rules on artificial intelligence (AI). On 20 October 2020, the European Parliamentary Assembly adopted, on the basis of three reports, three resolutions on AI from three different perspectives. These resolutions have recently (on 6 October 2021) been published in the Official Journal.

Read more

21.10.2021 EU law
Law and Artificial Intelligence (part one): towards a European civil liability regime? The European Parliament goes one step further…

Articles - For the European Union, it is time to have uniformed rules on artificial intelligence (AI). On 20 October 2020, the European Parliamentary Assembly adopted, on the basis of three reports, three resolutions on AI from three different perspectives. These resolutions have recently (on 6 October 2021) been published in the Official Journal.

Read more

21.10.2021 EU law
Law and Artificial Intelligence (part two): towards a European framework in line with the ethical values of the EU? The European Parliament goes one step further…

Articles - For the European Union, it is time to have uniformed rules on artificial intelligence (AI). On 20 October 2020, the European Parliamentary Assembly adopted, on the basis of three reports, three resolutions on AI from three different perspectives. These resolutions have recently (on 6 October 2021) been published in the Official Journal.

Read more