1. Implementing the New EU General Data Protection Regulation Conference 2016 Preparing for a DP audit Ashley Roughton Nabarro LLP

2. Audit, Investigations and Inspections – legal basis Any contract between C and P must require that –C can audit and inspect P (a26(2)(h)) for compliance with a26 –P assists C in that task Any DPO must monitor his employer’s compliance with the GDPR and related audits (a37) Any BCRs must have an audit provision within them (a43(2)(i)) SAs have the power to carry out investigations in the form of dp audits (a53) SAs to assist one another in relation to inspections (a55)

3. Investigations – legal basis Each SA has the mandate to –investigate lodged by S or a body representing S (a52(1)(b)) –Conduct investigations on the conduct of the GDPR (a52(1)(d)) The investigative powers include:- –Compel provision of information (a51(1)(a)) –Audit (a51(1)(aa)) –Access to premises and computers (a51(1)(db))

4. Corrective powers – a53(1b) Issue –Warnings –Reprimands Order –compliance with DSAR –modification of processing behaviour –Rectification, blocking or erasure of data –Payment of fine –Suspension of sending data abroad

5. a53 audits : (aa) “to carry out investigations in the form of data protection audits” Has the organisation implemented policies and procedures so as to ensure compliance with the GDPR Do they work Check –Appropriate policies and procedures in place –Being followed –Are they adequate –Detect breaches of compliance –Recommend changes

6. Audit standards Likely to be in accordance with the Chartered Institute of Internal Auditors standards on risk based reporting Standards on risk based auditing Ask one simple question : is there a risk of failure? Proportionate approach, is lapse or non-compliance:- –likely to have a serious impact –a reality?

7. Is there a risk of non compliance? Does the Controller have a complaint history Have there been any self reported breached If so what remedies have been proposed Has the controller in its communications displayed a lack of understanding of the rules Has the press or other business intelligence identified the controller as displaying a lack of understanding of the rules Have there been past audits Volume and nature of personal data being processed External accreditation Impact on individuals of non-compliance Whistle-blower reports, IAs of Controller

8. The seven areas Governance Training and awareness Security DSARs Sharing Records management PIAs

9. The audit process Letter(s) of request. –Policy documents –Operational guidance or manuals –Training modules –Risk and information asset registers The visit –Can take days –Opening meeting –Question/interview based approach –Visual inspections and examinations The report –Draft –Final –Publication of executive summary

10. Example of Executive Summary

11. a.roughton@nabarro.com