{"id":43430,"date":"2026-03-05T08:30:44","date_gmt":"2026-03-05T06:30:44","guid":{"rendered":"https:\/\/2b-advice.com\/?p=43430"},"modified":"2026-06-22T16:08:44","modified_gmt":"2026-06-22T14:08:44","slug":"audit-preparation-in-data-protection","status":"publish","type":"post","link":"https:\/\/2b-advice.com\/en\/2026\/03\/05\/audit-vorbereitung-im-datenschutz\/","title":{"rendered":"Audit preparation in data protection"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\n\t\t\t\t\t\"Picture\n\t\t\t\t<\/a>\n\t\t\t\n\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t

\n\t\t\t\t\t\t\tMarcus Belke\t\t\t\t\t\t<\/h4>\n\t\t\t\t\t<\/a>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

CEO of 2B Advice GmbH, driving innovation in privacy compliance and risk management and leading the development of Ailance, the next-generation compliance platform.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Good audit preparation means more than just providing complete documentation. It requires clear responsibilities, structured evidence and transparent processes. Companies that establish these structures at an early stage avoid stress during the audit and strengthen their governance at the same time. In this article, you will learn how auditors think, what weaknesses often occur in data protection audits and how you can prepare for an audit in a structured way.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

What auditors typically expect<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The auditing bodies (supervisory authority, internal audit, external auditor, client\/partner) may differ in tone, but rarely in the core statements. Auditors are looking for reliable answers to three key questions:<\/p>

  1. Does the organization know its processing?
    \u201eWhat do we process, why, for how long, with whom, where?\u201c (VVT<\/a> as core evidence).

    <\/li>
  2. Are the protective measures selected in line with the risk and are they effective?
    The TOMs are not just \u201eon paper\u201c, but have been implemented and checked in a comprehensible manner.

    <\/li>
  3. Are data subjects' rights and obligations operationalized?
    Information\/deletion, incident management, information obligations, withdrawal of consent must be defined as real processes with deadlines and responsibilities.

    <\/li><\/ol>

    It is also crucial for supervisory authorities that controllers and processors cooperate upon request. The cooperation behavior can also be relevant for fines (reduction\/assessment criterion).<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t

    Test methods that you should realistically plan for<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    In practice, a mixture of document reviews, structured questionnaires, interviews and spot checks are used. The fact that supervisory authorities can carry out data protection reviews and request information, among other things, is enshrined in the legal framework of powers.<\/p>

    The BayLDA questionnaire, for example, provides a very \u201eaudit-related\u201c perspective: it explicitly asks about data protection governance, the involvement of the data protection officer, VVT, privacy by design, processors\/contracts, information obligations, data subject rights, proof of consent and data protection management. This is practically a catalog of expectations.<\/p>

    Test methodology<\/strong><\/p><\/td>

    How inspectors recognize maturity<\/strong><\/p><\/td>

    Typical evidence<\/strong><\/p><\/td><\/tr>

    Document review (\u201eDesk\u00a0Audit<\/a>\u201c)<\/p><\/td>

    Consistency: VVT \u2194 TOM \u2194 DSFA \u2194 Contracts \u2194 Deletion periods \u2194\u00a0Duty to inform<\/a><\/p><\/td>

    VVT, TOM concept\/mapping, AV contracts,\u00a0Deletion concept<\/a>, DPIA\/risk analysis, proof of consent<\/p><\/td><\/tr>

    Questionnaire (official\/partner audit)<\/p><\/td>

    Ability to respond without \u201ead hoc invention\u201c; clear responsibilities<\/p><\/td>

    Completed questionnaires, verification index per question (voucher link)<\/p><\/td><\/tr>

    Interviews\/workshop discussions<\/p><\/td>

    Employees know the process, escalation, deadlines; no contradictory statements<\/p><\/td>

    Role matrix, training certificates, process manuals, ticket\/workflow examples<\/p><\/td><\/tr>

    Samples\/Walk-through<\/p><\/td>

    \u201eShow me\u201c: Information,\u00a0Deletion<\/a>, Authorization, incident response actually feasible<\/p><\/td>

    1-3 case files per process (DSAR tickets, deletion runs, authorization review, incident runbook)<\/p><\/td><\/tr>

    Technical evidence (demos\/logs)<\/p><\/td>

    Effectiveness and traceability (e.g. roles\/rights, 2FA, backup tests)<\/p><\/td>

    Authorization concepts, protocols, backup test protocols, MFA rollout proofs\u00a0<\/p><\/td><\/tr><\/tbody><\/table>

    Link tip:\u00a0GDPR questionnaire LDA Bavaria<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t

    Typical test questions and assessment criteria<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    The following examples are formulated in such a way that they are suitable for both authority and customer\/certification audits. They reflect typical questions from authorities (e.g. BayLDA questionnaire) and the DSK system (VVT\/DSFA\/rights of data subjects).<\/p>
    Theme block<\/strong><\/th>Typical test question<\/th>Assessment criterion (what \u201egood\u201c means)<\/strong><\/th>Typical evidence<\/strong><\/th><\/tr><\/thead>
    Governance<\/td>\u201eIs Data protection<\/a> A matter for the boss, are responsibilities regulated?\u201c<\/td>Responsibilities are documented and effective in everyday life<\/td>Data protection guideline, roles\/RACI, DPO integration concept<\/td><\/tr>
    Processing transparency<\/td>\u201eIs there a VVT, is it complete and up-to-date?\u201c<\/td>VVT covers real processing operations, incl. recipients, deletion periods, TOM description<\/td>VVT + change process\/review protocol<\/td><\/tr>
    Order processing<\/td>\u201eHave all processors been recorded and are DP contracts Art. 28 concluded?\u201c<\/td>Complete vendor list; AV contracts with minimum content; control mechanism<\/td>Vendor register, AV contracts, TOM audit Service provider\u00a0<\/td><\/tr>
    Rights of data subjects<\/td>\u201eCan you provide information within the deadline?\u201c<\/td>Process & organization ensure timely, comprehensible information<\/td>DSAR process, sample answers, ticket examples\u00a0<\/td><\/tr>
    Deletion<\/td>\u201eHow do you ensure deletion periods for each type of data?\u201c<\/td>Data deletion concept per data type; justified deadlines; documented deletion runs<\/td>Deletion concept, deletion logs, exception\/blocking rules\u00a0<\/td><\/tr>
    Risk\/DSFA<\/td>\u201eFor which processes do you carry out a DPIA?\u201c<\/td>DPIA before start; decision per process documented; measures derived<\/td>DSFA reports, threshold value analysis, action plan<\/td><\/tr>
    Consents<\/td>\u201eCan you prove consent and enable revocation?\u201c<\/td>Verifiability, information, revocation mechanism<\/td>Consent register, UI screenshots, logs\u00a0<\/td><\/tr><\/tbody><\/table>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Frequent weaknesses in audits<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    The following weaknesses are not \u201etheoretical errors\u201c, but typical gaps between paper compliance and everyday life. The examples are deliberately based on official audit questions and good practice catalogs (e.g. TOM checklists), as auditors ask questions precisely where implementation is often incomplete.<\/p>

    Technical defects<\/h5>

    A frequent audit finding is not \u201eno TOM\u201c, but TOM without reference to effectiveness: although there is a PDF with keywords, there is no reliable evidence that measures have been implemented, tested and selected in line with the risks. Although the benchmark \u201eregularly review\/assess\u201c is explicitly addressed, it is practically impossible to fulfill without a concrete description.<\/p>

    Concrete, often criticized technical examples:<\/p>