[Day 3] 11. An Actual Compliance Audit

What is a Compliance Audit?

A compliance audit is a structured evaluation of an organisation's policies, processes, and practices to ensure they meet specific legal, regulatory, or internal standards.

In the case of GDPR compliance, the audit focuses on:

Verifying that personal data is handled lawfully, transparently, and securely.
Ensuring user rights, data protection practices, and organisational security policies align with GDPR requirements.

Steps and Checklist for a GDPR Compliance Audit

1. Documentation Review:

Verify the purpose of collecting personal data is clearly defined and documented.
Check the privacy policy for clarity, completeness, and accessibility to users.
Confirm that a Data Protection Impact Assessment (DPIA) has been conducted for high-risk processing activities.
Ensure there are records of data processing activities (Article 30 GDPR).

2. User Consent and Awareness:

Confirm that users are aware of the purpose of data collection.
Check whether users have provided explicit consent before data collection or processing.
Validate the availability of a consent withdrawal mechanism.

3. Data Storage and Handling:

Verify that data storage systems are secure and comply with encryption standards.
Check whether personal data is anonymised where applicable.
Ensure data retention policies are being followed, with data deleted when no longer necessary.

4. Access Control and Rights Management:

Audit who has access to personal data and validate role-based access control (RBAC) implementation.
Check for regular reviews of access rights and immediate revocation upon employee termination or role change.
Ensure sensitive data cannot be copied without authorisation.

5. Data Transfers:

Evaluate the purpose and method of data transfers.
Verify compliance with GDPR requirements for cross-border transfers, e.g., use of SCCs (Standard Contractual Clauses).
Confirm encryption or secure channels (e.g., HTTPS) are used during data transmission.

6. Data Security Measures:

Confirm the presence of anti-virus and OS updates on all systems.
Audit whether unused PCs or public systems are appropriately secured or decommissioned.
Ensure critical systems with sensitive data have heightened protection measures.

7. Incident Management:

Verify there is a breach notification procedure, including a 72-hour reporting rule.
Check logs for any unreported incidents or near-misses.

8. Employee Training and Workload:

Validate that all employees handling personal data are trained in GDPR requirements.
Assess the workload of key employees and recommend hiring assistants if necessary.

Practical Activities During the Audit

Scan Systems and Devices:
- Audit PCs in public regions for outdated OS or anti-virus software.
- Prioritise checking unused or rarely used devices, as they may pose vulnerabilities.
- Begin with critical systems containing sensitive user data to ensure they are appropriately secured.
Conduct Interviews:
- Speak with employees to confirm their understanding of GDPR practices.
- Ensure employees handling sensitive data have signed Non-Disclosure Agreements (NDAs).
Physical Security Audit:
- Check that server rooms, storage areas, and other secure locations are accessible only to authorised personnel.
- Confirm there is no unauthorised access or copying of sensitive data.

Additional Questions to Address During a GDPR Audit

Is there a designated Data Protection Officer (DPO)?
Are periodic security tests (e.g., penetration testing) conducted?
How is data permanently deleted when no longer needed?
Are there policies for vendor and third-party compliance with GDPR?
Are backups encrypted and tested regularly?

Outcome of the Audit

Compliance Status Report: Summarise findings, identifying areas of non-compliance.
Recommendations: Suggest improvements, such as hiring additional personnel, implementing stricter access controls, or upgrading outdated systems.
Follow-Up Actions: Establish a plan for addressing any non-compliance issues identified during the audit.