Datenschutzaudit

Whether your data protection measures work is rarely apparent in everyday work, but rather when someone looks closely. A data protection audit is this close look, planned and methodical. Here you can find out what a data protection audit is, how it proceeds and why decommissioned IT is often a weak point.

What is a data protection audit?

An audit is a review against a fixed benchmark. In a data protection audit, the benchmark is the GDPR, the BDSG and internal policies. The auditors compare the target state with the actual state and record deviations in a report.

There is no dedicated "data protection audit law" in Germany. The obligation to review arises from several places in the GDPR: Art. 5(2) requires that you can demonstrate compliance (Accountability). Art. 32(1)(d) calls for a procedure to regularly test the effectiveness of the protective measures. And Art. 28(3)(h) gives you the right to audit processors, including on site.

Types and process

Type	Who audits?	Typical occasion
Internal audit	Data protection officer, internal audit department	Annual review, new processes
Service provider audit	Your company at the processor	Selection or ongoing monitoring under Art. 28 GDPR
External audit	Independent auditors or certification body	Certification, customer requirement
Review by the supervisory authority	State data protection authority	Complaint, data breach, spot check

The process is usually similar: define the scope, request documents, conduct interviews and observe processes on site, draw samples, assess deviations and agree measures. A good report names not only defects but also by when they will be remedied.

What an audit looks at for decommissioned IT

In everyday work, servers and notebooks are well protected. It becomes critical when devices drop out of operation and end up in boxes, basements or at the service provider. Auditors therefore typically ask:

• Is there a device list with serial numbers for every decommissioning?
• Is every handover documented, for example by a handover record with seal numbers? This chain is called Chain of custody.
• Is there an erasure or destruction proof for every data carrier that can be assigned to the serial number?
• Is there a data processing agreement with the service provider and a description of its technical and organizational measures?

What information should appear in erasure and destruction proofs is shown in our guide Certificate of destruction and erasure report. Questions you should ask a service provider in advance can be found in Choosing an ITAD provider.

Data protection audit and Second IT

Second IT provides the documents you need for your audit: digitally signed erasure certificates for each device, certificates of destruction, audit reports and live tracking in the customer portal. The processes are certified in accordance with ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001. At least three external audits take place per year. Access control, video surveillance and the obligation of employees to maintain data secrecy are part of the Data security at Second IT.

Frequently asked questions about the data protection audit

Is a data protection audit mandatory?

The GDPR does not prescribe an audit by that name. It does, however, require that you regularly test the effectiveness of your protective measures and can demonstrate compliance (Art. 5(2) and Art. 32(1)(d) GDPR). An audit is the usual way to do this.

How often should a data protection audit take place?

There is no fixed deadline. Many companies audit once a year and additionally for major changes, such as a new service provider or a new decommissioning process.

Do I have to audit my disposal or erasure service provider myself?

You have the right to do so (Art. 28(3)(h) GDPR). In practice, current certificates and audit reports from independent bodies often replace your own on-site inspection. What matters is that you have assessed the service provider’s suitability in a traceable way.

What is the difference between an internal and an external data protection audit?

An internal audit is carried out by data protection officers or the internal audit department. An external audit is carried out by independent auditors or a certification body, for example for a certification or at customers’ request. External auditors bring an independent view from outside.

What happens to the identified defects after a data protection audit?

The deviations are recorded in a report. A good report also states by when they are to be remedied. You then agree the measures and determine who implements them.