The DPO’s Guide to Data Privacy Audits: 5 Key Areas to Check
GDPR imposes several obligations on a data controller. One of these obligations is the requirement to conduct audits as part of “Compliance with Legislation.” I will discuss 5 main areas, a DPO should take into consideration it audits of data privacy.
According to Article 28 of the GDPR, the controller (the entity that determines the purposes and means of the processing of personal data) shall only use processors (the entity that processes personal data on behalf of the controller) that provide sufficient guarantees to implement appropriate technical measures.
A GDPR audit is a systematic and independent examination of an organization’s data protection activities to assess the level of compliance with the GDPR and identify any gaps or risks that need to be addressed. Conducting an audit for data privacy area can bring several benefits to an organization, including:
- Demonstrating accountability and transparency to the supervisory authority, data subjects, and other stakeholders.
- Enhancing the reputation and trustworthiness of the organization.
- Avoiding or reducing the likelihood of fines, penalties, or legal actions for non-compliance.
- Improving the efficiency and effectiveness of data protection processes and controls.
- Identifying and mitigating potential data breaches and security incidents.
- Fostering a culture of data protection awareness and best practices within the organization.
A data privacy audit can be conducted internally by the organization’s staff, such as the data protection officer (DPO), or externally by a third-party auditor, such as a consultancy firm or a certification body. In this article I discuss the critical things a DPO pays attention to in a data privacy audit
As I discussed in my article titled “Do You Know Your Limits?”, problems caused by breaches of data privacy are increasing globally. A data breach can lead to significant financial losses and damage to the reputation of an organization. Conducting thorough audits, identifying control weaknesses, and taking necessary actions are crucial steps to avoid unfavorable outcomes.
There is no detailed explanation of how the data privacy audit should be carried out in the legislation. When faced with many questions on this topic, I prepared this article to assist you. In my previous experience in EY Turkey, I have completed several data privacy compliance projects in various sectors. A data privacy compliance project or an audit of data privacy forces a consultant to touch upon almost all business processes from various perspectives. For this reason, the team that will conduct the data privacy audit should include experts in various fields within the framework of the integrated audit approach recommended by the Institute of Internal Auditors (IIA): IT audit, legal, process, cybersecurity, and technology experts.
Based on my experience, the duration of a data privacy audit varies depending on the size of the organization, ranging from 3 to 4 weeks. Now, let’s discuss what to pay attention to in data privacy audits based on the headings in the image. The first item is legal matters, but since this area falls within the jurisdiction of our legal teams, I will skip this part. And
1. Governance and Organization Structure:
I wouldn’t be exaggerating if I said that the first requirement for successful data privacy compliance falls under this heading: establishing the data privacy governance structure, defining roles and responsibilities, creating reporting procedures, determining new roles and responsibilities related to data processing, storage, and destruction processes, roles of suppliers and service providers, and data privacy awareness campaigns.
In our compliance projects, we recommend establishing a “Data Privacy Governance Model” and forming a committee to coordinate the activities carried out within the scope of data privacy compliance. We often encounter questions about who should be part of this structure and what their responsibilities should be. Below, I am sharing a study that guides on this topic. You will also be directed to a link where you can find more in the IAPP-EY Annual Governance Report 2023.
Depending on the industry in which the organization operates, the responsibility for this structure usually lies within the legal or information security departments, with representatives from the Legal/Compliance Directorate, Information Technologies Operations Directorate, information security/cybersecurity unit, and representatives from the operations and process units. However, the organization can determine this structure according to its own needs.
“Accountability” is of great importance in the protection of personal data. Therefore, it is necessary to establish an effective Personal Data Protection Program under the “Governance and Organization” heading. To ensure that this program operates effectively, performance indicators (completion rates of training, number of fines received, number of impact analysis processes performed, etc.) need to be defined, and these indicators should be regularly evaluated and reported to monitor the situation.
You can see an example list of Key Performance Indicators (KPIs) on the screen. (The measurement process of KPIs is recommended for the sustainability of the data privacy compliance program, but there is no legal requirement for such a process.) The efficiency of KPIs being tracked and whether the process of measuring and reporting them is designed and effective should be questioned during audits.
In the image, I also provided a hint for testing KPI effectiveness — SMART. We can question how well each element of this acronym is met to evaluate how effective our KPIs are within the framework of our defined data privacy compliance program. Here are a few test questions related to what to pay attention to under the “Governance and Organization” heading:
- Is there a designated data privacy contact person within the company?
- Are the policies required by the Data Privacy Act established?
- Have top management approvals been obtained for these policies?
- Are these policies being implemented?
2. Legal Aspects
During the audit, the experts should thoroughly examine the organization’s compliance with relevant data protection laws and regulations, including the GDPR, the ePrivacy Directive, and the local data protection laws of the countries where the organization operates or has customers. Furthermore, the auditor can assess the adequacy and effectiveness of the organization’s data protection policies, procedures, and practices.
This assessment should encompass the data protection impact assessment (DPIA), data breach notification, data subject access request (DSAR), data retention and deletion, data minimization and purpose limitation, data quality and accuracy, data security and confidentiality, and data transfer and sharing.
Additionally, the auditor can describe the roles and responsibilities of the organization’s data protection officers (DPOs), data controllers, data processors, and data sub-processors. It is also important to include information on the contractual and legal arrangements between these parties, such as the data processing agreement (DPA), standard contractual clauses (SCCs), or binding corporate rules (BCRs).
Furthermore, the auditor should assess the level of awareness and training among the organization’s staff, management, and stakeholders regarding data protection issues and best practices. Additionally, it is crucial to describe the communication and engagement with data subjects and supervisory authorities on data protection matters.
Lastly, the auditor should evaluate the risks and opportunities associated with the organization’s utilization of emerging technologies and innovative solutions, such as artificial intelligence (AI), machine learning, big data, cloud computing, biometrics, or blockchain. Furthermore, it is important to discuss the ethical and social implications of the organization’s data processing activities.
3. Process Adaptation:
In general, it can be stated that organizational culture and understanding, which have developed over many years, are encountering heightened cyber threats as a result of the rapid digital transformation in recent years. Stakeholder expectations regarding data privacy are also on the rise. The IAPP Privacy and Consumer Trust Report indicates an increased interest in the demand for reliable protection against cyber threats worldwide. As a result of these escalating threats, data privacy audits play a more crucial role than ever before in sustaining the trust of our customers.
Please note that, as in all projects, there should be a clear and detailed definition of the scope of data privacy audits. All phases of this project, from the determination of the scope to the preparation of the final report, should be carefully managed. For data privacy audits, the inventory of personal data (the sensitive/non-sensitive classification of personal data, the owners of personal data, the purposes for which personal data are processed, the retention period, the data processing activity, data transfer processes, etc.) must be created and managed efficiently.
While creating the inventory, it is important to ensure that it is “dynamic.” The reason for this is that the importance of the data changes over time and the personal data inventory needs to be updated regularly. You should consider the need for new data processing activities, data transfers, and other factors when creating your inventory.
It is important to determine whether the processes performed within the scope of data privacy compliance meet the requirements and goals set out in the data processing policy. While determining the processes that are in scope, it is also important to determine the processes that are not in scope.
In data privacy audits, the processes in which personal data are processed are divided into two: “Primary Processes” and “Supporting Processes.” Personal data is used within the scope of primary processes to achieve the purpose of the organization and to carry out its main business activity. For example, the processes of a bank that processes the personal data of its customers are primary processes. The supporting processes, on the other hand, are processes that support the primary processes, and personal data is used here to ensure the continuity of the primary processes. For example, Human Resources processes in the bank are considered supporting processes.
During the creation of the inventory, it is important to include both primary and supporting processes, and while creating the audit plan, priority should be given to the processes that are critical in terms of compliance.
While creating the inventory, make sure that you clearly identify and label your processes and also mention whether these processes are primary or supporting processes. This will help you when it comes to determining which processes are critical for compliance and auditing them.
To ensure compliance, the impact analysis processes of personal data should be performed correctly. When assessing the impact, the following should be considered: What will happen if the personal data processed in the company is compromised, lost, or accessed by unauthorized persons? Impact assessment is a critical component of both data protection and compliance.
For this reason, it is important to conduct an impact analysis of personal data correctly. In our data privacy compliance projects, we guide our clients in this regard. We explain to them how impact analysis should be conducted in simple and clear language. We have observed that this approach helps our clients understand the process more easily and enables them to perform impact analysis more efficiently.
During the audit process, the auditor should determine whether the impact analysis has been performed correctly and whether the data protection measures have been implemented effectively. To do this, the auditor can use checklists prepared in advance.
4. Data Management:
The most crucial factor in the success of a data protection program is to classify and label data correctly. Organizations must correctly classify personal data according to their content, determine how sensitive the data is, and apply proper labeling.
For this, data owners must be identified within the organization. Data owners are responsible for determining the classification of the data they manage and ensuring that they are labeled correctly. Therefore, they should be selected correctly and trained on their responsibilities.
The process of determining who the data owners are and what their responsibilities are is crucial in ensuring the correct management of personal data. When the data is labeled correctly, it becomes easier to determine the access authorization.
Data owners should also determine the purposes for which personal data are processed, the categories of recipients, the data transfer processes (transferring data abroad), and retention periods. They should also determine the risk level of personal data and the necessity of data protection.
5. Information Security:
While determining the access authorization, it should be ensured that all authorized persons are defined and controlled. The relevant stakeholders should have an authorization matrix for access to personal data, and it should be ensured that the relevant documents are approved by management. In determining the access authorization, the organization should review and approve the “Access Matrix.” The access matrix is a document that determines who has access to what information, what permissions they have, and who can make changes to this matrix.
The IT department should ensure that the access matrix is followed, and no one can access data without authorization. The IT department should also monitor data access through the access matrix and ensure that it is reported regularly. Information security policies and procedures should be written and approved, and access control should be defined. Control mechanisms should be established to ensure that these policies and procedures are followed.
The organization should determine what is required in terms of information security for data processing activities. In particular, data transfer activities should be closely monitored. In data transfer processes, the data owner should review and approve the data transfer request.
Data transfer is one of the riskiest processes in terms of data privacy compliance. For this reason, data transfer processes must be strictly controlled. In data transfer processes, the consent of the data subject is also crucial. Therefore, data subjects must be informed about the data transfer process and give their consent explicitly.
At this point, it is essential to create awareness among employees about data privacy. Awareness is critical for compliance. In our data privacy compliance projects, we provide training for our client’s employees.
During audits, the auditor should review whether the employees who have undergone training are aware of the issues related to data privacy and whether this awareness is reflected in their daily work. Auditors can evaluate the effectiveness of these trainings by conducting interviews with employees.
Summary
In today’s data-driven world, data privacy audits are indispensable for organizations. They not only guarantee compliance with stringent data protection regulations but also act as a shield against reputation risks. These comprehensive audits encompass critical domains such as governance, streamlined processes, robust data management, unwavering information security, and meticulous auditing practices. As you delve deeper into this article, you’ll discover the vital strategies and insights necessary to safeguard your organization’s data integrity and reputation. Get ready to embark on a journey towards data privacy excellence in our upcoming articles!
