Must a company we wish to work with consent to audits and/or periodic completion of a security questionnaire?

ANSWER

The controller's right to conduct audits / request completion of a security questionnaire does not depend on the processor's consent. Making available all information necessary to demonstrate compliance with the obligations set out in Article 28 GDPR (including, among other things, security measures applied) and allowing the controller, or an auditor authorised by the controller, to conduct audits, including inspections, and contributing to them — are processor obligations arising from the GDPR (Article 28(3)(h) GDPR). Provisions in this regard should be included in the processing agreement as a mandatory element.