GDPR audit and compliance for companies

Interviews trace flows in sales, HR, marketing, support, accounting, security and product. For each purpose, the data subjects, data, source, recipients, systems, transfers and retention period are recorded.

This map enables the role of controller, joint controller or processor to be established and feeds the record required by Article 30. The exemption for organisations with fewer than 250 employees is limited and must not be assumed automatically where processing is not occasional or involves risk or sensitive data.

Every purpose needs a legal basis and coherent information. Consent is not a universal solution, and legitimate interests require analysis, documentation and a genuine right to object where the law recognises it.

• Purpose and legal basis: defined separately, without incompatible reuse.
• Data: only what is necessary, with role-based access limits.
• Information: clear, accessible and delivered at the right time.
• Retention: criteria and periods technically implemented, not merely declared.
• Providers: contracts, instructions, subprocessors and transfers.
• Data subjects: channel, identity, deadlines and response records.

Article 32 requires technical and organisational measures appropriate to the risk. The legal audit does not replace technical testing, but examines access governance, backups, encryption, logging, provider management and the incident procedure.

Processing likely to create a high risk must be analysed to determine whether a DPIA is needed. Launching new technology, combining databases or systematic monitoring may change the assessment even if the old documents have not changed.

Findings are prioritised by risk, effort and dependencies. Urgent measures may concern uncontrolled access, missing contracts, transfers or retention; structural measures may require technical development and staff training.

Each measure identifies the responsible person, deadline and evidence of completion. Management must be able to track progress, and policies must be tested through exercises: responding to requests, simulating a breach and checking deletion.