Data protection audit program: technical and organisational measures.
How to audit whether the security of processing personal data is appropriate to the risk and whether the effectiveness of the measures is reviewed regularly.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether controllers and processors ensure a level of protection for personal data appropriate to the risk: risk consideration, encryption and pseudonymisation, confidentiality, integrity, availability and resilience of systems, restoration after incidents and regular review. It also assesses whether employees handle data only on instruction and whether processors are involved appropriately.
Scope
- Processing activities involving personal data, selected by risk, and the systems used for them
- Technical measures such as encryption, access protection, backup and logging
- Organisational measures such as policies, training, commitments and incident processes
- Out of scope: lawfulness of processing, data subject rights and transfers to third countries, unless agreed separately
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | The risk to the rights and freedoms of data subjects is assessed for the processing activities; the assessment takes account of likelihood and severity and is current. | GDPR Art. 32(1) and (2) | Review the risk assessment for five processing activities and check its currency and how the level of protection is derived. | Record of processing activities, risk assessments |
| 2 | The measures are documented and proportionate to the risk, taking account of the state of the art and the costs of implementation. | GDPR Art. 32(1) | Read the catalogue of measures and trace the allocation of measures to risk for three processing activities. | Measures concept, allocation of risk and measure |
| 3 | Personal data is encrypted or pseudonymised where appropriate, in storage and in transit. | GDPR Art. 32(1)(a) | Check encryption settings for databases, backups, mobile devices and transmission paths in a sample. | Configuration extracts, encryption and pseudonymisation concept |
| 4 | Confidentiality is secured by an authorisation concept: access only for authorised people, on a need basis, with regular review. | GDPR Art. 32(1)(b); ISO/IEC 27001:2022 Annex A 5.15 | Compare authorisations on systems holding personal data with the concept and review the last review. | Authorisation concept, rights extracts, review record |
| 5 | Integrity of data and systems is secured, for example through change protection, logging and checks for unauthorised alteration. | GDPR Art. 32(1)(b); ISO/IEC 27001:2022 Annex A 8.15 | Check logging of changes to data sets and protection of the logs in two systems. | Logging configuration, evaluations |
| 6 | Availability and resilience of systems are secured through redundancy, capacity planning and protection against malware. | GDPR Art. 32(1)(b); BSI OPS.1.1.4 | Compare availability requirements with the technical implementation and check coverage of malware protection. | Architecture overview, availability reports, coverage of protection software |
| 7 | After a physical or technical incident, availability of and access to data can be restored quickly; restoration is tested. | GDPR Art. 32(1)(c) | Read the backup and restoration concept and review the results of the last restoration test. | Backup concept, record of the restoration test |
| 8 | The effectiveness of the measures is tested, assessed and evaluated regularly under a defined procedure; results lead to measures. | GDPR Art. 32(1)(d) | Review the audit plan and reports of the last twelve months and follow up the implementation of measures. | Audit plan, reports of internal and external audits, action list |
| 9 | People with access to personal data process it only on instruction and are bound to confidentiality and trained. | GDPR Art. 32(4) | Check commitment statements and training records for a sample of employees. | Commitment statements, training records, instructions |
| 10 | Contracts with processors regulate technical and organisational measures, binding instructions, sub-processing and audit rights. | GDPR Art. 28(1) and (3) | Review the contracts of three processors against a checklist and compare the annexes on measures with practice. | Processing contracts, annexes on measures, checklist |
| 11 | Compliance by processors is monitored, for example on the basis of evidence or audits. | GDPR Art. 28(3)(h) | Review evidence and checks of the last twelve months for essential processors. | Certificates, audit reports, records of checks |
| 12 | Personal data breaches are detected, documented and assessed and reported within the deadline. | GDPR Art. 33(1) and (5) | Check the procedure for data breaches and review documentation and reports of the last twelve months. | Procedure, documentation of breaches, reports |
Documents to request
- Record of processing activities
- Risk assessments for the processing activities in the sample
- Measures concept with allocation to risk
- Authorisation concept and rights extracts
- Encryption and pseudonymisation concept
- Backup concept and record of the last restoration test
- Processing contracts with annexes
- Audit plans and reports on the review of measures
Typical findings
- Measures are not tied to the risk of the processing activity; one standard package applies to all.
- The authorisation concept is not implemented, and too many people access data sets with personal data.
- Backups are not encrypted, and restoration tests are missing.
- The effectiveness of the measures is not reviewed regularly.
- Annexes on technical and organisational measures at processors are outdated or general.
- Employees are not demonstrably committed and trained.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing