Is My Company GDPR-Compliant?

With the GDPR in force for more than a year, most companies have spent a lot of time and money to implement the new requirements under data protection law.

Now that the initial hectic pace of implementation has subsided, businesses should take their time to subject the results to a critical review. This serves to avoid surprises when a data subject files a complaint or the supervisory authority initiates an audit.

In a highly useful move, the supervisory authorities have published the questions they are asking in connection with their initial audits. The Lower Saxony State Commissioner for Data Protection published the "2018/19 criteria catalogue for cross-sectional audits in business" (https://lfd.niedersachsen.de/startseite/datenschutzreform/ds_gvo/kriterien-querschnittspruefung-179455.html). It not only contains standard questions on the records of processing activities or on the rights of data subjects, but also in-depth information on about 200 individual