Audit of the GDPR how to carry out a compliance audit with the GDPR

A RODO audit is a detailed analysis of how your company processes personal data. It examines both business processes and technical safeguards as well as documentation.

• •Analysis of data processing activities – we check whether data is collected lawfully, only to the extent necessary, and whether it is properly protected.
• •Assessment of IT security – we verify the effectiveness of applied measures, such as encryption, firewalls, antivirus systems and updates.
• •Review of documentation – we analyse privacy policies, terms and conditions, internal procedures and RODO registers.
• •Checking consents and forms – we assess whether clauses are clear, voluntary and compliant with RODO.
• •Checking cookies and websites – we verify whether the site correctly informs about cookies and obtains users' consents.

• •Before implementation of new processes – so that they operate in compliance with the law from the outset.
• •After changes are introduced – e.g. a new IT system, marketing tool or application.
• •In the event of incidents – when a data leak or breach occurs.
• •Regularly – preferably once a year, to respond to changing regulations and new threats.

• •Proof of compliance with regulations – in case of an inspection you can demonstrate that you apply appropriate data protection measures.
• •Risk identification – allows you to find gaps before UODO or a hacker does.
• •Greater security – highlights areas requiring improvement and strengthens data protection.
• •Building trust – shows clients and partners that your company takes privacy seriously.

An RODO compliance audit is an independent assessment of an organisation's functioning with regard to personal data protection regulations. The combination of these two perspectives and competences (legal and IT) means that after the audit we are able to develop comprehensive personal data protection documentation and provide concrete recommendations – both legal‑organisational and related to IT security. According to the recommendations of the President of the Personal Data Protection Office, an RODO audit should be carried out regularly, e.g. once a year. The audit is conducted in the formal‑legal and technical‑informational (IT) areas. Our clients receive a professional service at a favourable price, compliant with international standards and with the ODO 24 Auditor's Code of Ethics.

An RODO compliance audit is the first step towards organisational security in the area of personal data protection. The aim of the audit is the correct determination of the baseline situation in the area of data protection – a precise inventory of the information assets held and the methods of their processing and protection.

The RODO formal‑legal audit includes: an analysis of personal data processing activities in respect of which the organisation acts as a processor, the exercise of the rights of data subjects (including: the right of access to personal data, the right to rectification and erasure of data, the right to be forgotten, the right to restriction of processing, the right to data portability, the right to object, the rules on automated decision‑making in individual cases), an analysis of applicable personal data processing policies and procedures, an analysis of personal data processing activities in respect of which the organisation is a data controller (including: lawfulness of processing, fulfilment of the information obligation towards data subjects, arrangements for commissioning data for processing, rules for transferring data to third countries or international organisations, consideration of data protection in the design phase and data protection by default).

A RODO audit in the technical and IT area covers: verification of the access control mechanisms used for IT systems, analysis of the adequacy of physical protections (including server rooms, archive, HR department rooms, the IT department and accounting), checking the process of access-rights management, verification of the backup management process, assessment of the security of workstations, mobile devices, media and devices, checking the security of communications in LAN/WAN, verification of ICT and physical security documentation, and checking the level of knowledge and awareness of the organisation’s employees (online tests, in-depth interviews).

An audit of compliance with the General Data Protection Regulation (RODO) comprises several key stages that help an organisation assess and adapt its activities to the requirements of RODO implementation within the enterprise. Below are the main stages of this process:

• •Analyses of documentation and policies: Auditors review documentation related to the processing of personal data, such as policies, procedures, privacy notices and contracts. The aim is to verify whether the documentation is complete, compliant with RODO requirements and whether it transparently informs stakeholders about data processing.
• •Assessment of activities and processes: During the audit, the organisation’s personal data processing processes are analysed, including the collection, storage, transmission and deletion of data. Auditors assess the compliance of these processes with RODO principles, including data minimisation, purpose limitation and the right to be forgotten.
• •Verification of data protections: Auditors assess the data protection measures in place, such as encryption, access control and event monitoring, to ensure they comply with RODO requirements regarding data protection.
• •Assessment of incident response: The audit examines procedures and actions in the event of personal data breaches. The aim is to ensure the organisation has appropriate mechanisms to respond promptly to incidents and to report them to the relevant authorities.
• •Training and employee awareness: Auditors check whether the organisation provides training on personal data protection for employees, and whether there is awareness among staff of RODO principles and the need to comply with them.
• •Report and recommendations: After the audit, auditors prepare a report containing the audit findings, including identified non‑compliances with RODO and recommendations for corrections and improvements to data protection-related activities.

An audit should primarily be well prepared and planned. Auditors, before taking explanations from staff, should familiarise themselves with the documents in force within the organisation in order to understand how it operates. The audit interviews themselves should be conducted in a cooperative atmosphere, because both parties are working towards the same objective – they both care about the security of personal data. Of course, each auditor should conduct the audit within their area of competence - law or IT - so that ultimately our client receives a reliable and factually accurate summary answering the question of whether your organisation is RODO‑compliant, and if not, what needs to be done to achieve compliance.

The checklist for an audit carried out by ODO 24 consists of the following elements: obligations of the data controller (ADO), obligations of the Data Protection Officer (DPO), processing activities for which you are the data controller (ADO), processing activities for which you are the data processor, IT security. On our course for the Data Protection Officer (DPO) you will receive the RODO checklist. In this training we will teach you how to conduct a RODO compliance audit.

You can tailor the scope of an external RODO compliance audit to your needs. A comprehensive RODO compliance audit includes: an initial remote audit, a RODO compliance audit of the website, a RODO compliance audit of mailing campaigns, contests, a RODO compliance audit of the recruitment process, an audit of DPO documentation, an audit of cooperating entities that process data. The price of a comprehensive RODO compliance audit may vary depending on many factors, such as company size, the number of personal data processed, the type and volume of data processed, the sophistication of IT systems, the number of employees, the scope of audit-related work and many other factors. A competitive price for a comprehensive RODO compliance audit should be dependent on the specific needs and requirements of the company, while offering value that outweighs the costs. It is worth ensuring that you choose an experienced and reliable company that will conduct the audit in accordance with the highest standards and with RODO requirements.

We understand that the business environment in which our clients operate is dynamic, and their priorities sometimes change. An audit report is a reliable and documented assessment of an organisation's compliance with RODO, containing detailed recommendations on how to remedy any gaps or deficiencies in clauses, notices, records or procedures. A RODO audit report constitutes evidence for the President of the Polish Data Protection Authority (Prezes UODO) that the organisation regularly and reliably assesses the effectiveness of data protection measures. A good quality-to-price ratio in this case means that the client pays a reasonable price for a valuable report.