Data protection regulations must be observed
When preparing the annual financial statements, auditors inspect a large number of company documents. Data protection regulations must also be observed.
In principle, the auditor has a right of inspection in accordance with Section 320 (2) sentence 1 HGB. This standard states that the auditor can request all information and evidence from the legal representatives that is necessary for a thorough audit. However, almost all company documents contain personal data in accordance with Section 3 (1) BDSG, not only of the company's customers but also, in particular, of its employees.
Even if Section 320 (2) sentence 1 HGB gives the auditor a very comprehensive right of inspection according to the commentaries on commercial law (e.g. Baumbach/Hopt, HGB, Section 320), this must nevertheless be measured against the admissibility standards under data protection law.
Disclosure of Data to Auditors
The transfer of company documents to auditors is to be regarded under data protection law as Transmission to be classified. This could be permissible Transmission be, if all employees are included in the Transmission have consented to being included on the lists. This will generally not be the case, so a legal basis for processing under data protection law must apply. Section 28(1), sentence 1, no. 2 of the BDSG may be applicable in this regard.
It is in the company’s legitimate interest to prepare accurate and legally compliant financial statements. In doing so, particular attention must be paid to the principle of necessity. There must be no less restrictive means by which the financial statements can be prepared with the same result.
For example, certain information can also be verified using anonymized statistical data. However, it must also be taken into account here that the auditor must of course be able to check the statistical data. Companies should note that Section 320 (2) sentence 1 HGB is not a special law that takes precedence over the BDSG, as it does not explicitly cover the Processing of personal data. However, this is absolutely necessary for the subsidiarity of the BDSG. Companies should consult with their data protection officer to determine which information is required for which purposes. In particular, the exact purposes of the requested data must be obtained from the auditors.
Comply with data protection principles
Under the current GDPR is the Transmission Regular disclosure of personal data to auditors pursuant to Article 6(1)(c) GDPR (Compliance with a legal obligation) or Art. 6(1)(f) GDPR (legitimate interest). At the same time, the principles of Data minimization, Earmarking and Confidentiality pursuant to Article 5 GDPR Please note: Companies should therefore determine which personal data is actually necessary for the specific audit and provide the auditor only with the information required to conduct the financial statement audit. Where possible, personal data may be provided in pseudonymized or aggregated form without compromising the auditability of the documents.
In addition, collaboration with auditors regarding the company’s data protection management should be documented. This includes, in particular, defining the respective roles under data protection law, which Documentation the legal basis for the data transfer and the inclusion of audit activities in the record of processing activities. Since auditors are generally subject to a statutory duty of confidentiality, a high level of protection for the processed information already exists. Nevertheless, the company remains obligated to ensure compliance with data protection principles throughout the entire audit process.
German 
English 
Italian 
French