Compliant Or Non-Compliant? GDPR Audits As A Self-Control Tool

In order to ensure a high level of data protection within the EU, the GDPR provides for strict compliance responsibility on the part of companies processing personal data. As they are accountable by law, companies have to comply with the regulation and must be able to prove their compliance, e.g. upon request of the supervisory authorities. Respective inspections by supervisory authorities may occur on a case-related basis or without any particular reason.

If companies are unable to prove their compliance, they may face heavy fines. Record-breaking fines show that the supervisory authorities are not afraid to use their powers. In order to avoid these fines, it is not enough to singularly adapt internal processes to the legal requirements. Companies must constantly maintain the data protection standard they have created, especially since the GDPR is not yet a well-established legal framework. Therefore, the opinions of the supervisory authorities and the courts have