When conducting an audit/inspection of premises outside office hours, should the audited units be notified in advance?

ANSWER

The decision on whether to notify the audited units is made by the data controller, in cooperation with the Data Protection Officer or another auditor. If the aim is to verify the actual situation within the organisation, the controller may decide not to inform employees of the upcoming audit.