How to Audit a Data Processor’s GDPR Compliance

Entrusting processing to a provider does not transfer the controller’s responsibility. The GDPR requires the controller to use only processors providing sufficient guarantees, and then to be able to demonstrate this. The audit is the tool for this twofold requirement: it makes the initial choice legally sound and it checks, over time, that commitments are being honoured. It still has to be organised properly, because an audit right that is poorly drafted or never exercised has no evidential value on the day of an inspection or an incident. The approach is built in three stages: select, provide for the audit in the contract, then exercise it proportionately, without overlooking sub-processors.

The practical terms of an audit (frequency, notice, use of a third party, allocation of costs) depend on the data processing agreement. The analysis below describes the framework, not a solution tailored to a specific contractual relationship.

Auditing your processor: an obligation, not just an option

The accountability principle in Article 5(2) of the GDPR requires the controller to demonstrate its compliance; combined with Article 28(1), it leads the controller to check the guarantees offered by its processors. The audit is therefore not a contractual convenience: it extends an obligation. In addition, Article 28(3)(h) makes the audit right a mandatory clause of the contract: the processor must make available “all information necessary to demonstrate compliance with the obligations” and “allow for and contribute to audits, including inspections”.

Before the audit: choosing a processor that provides sufficient guarantees

Article 28(1) makes the use of a processor conditional on “sufficient guarantees” as to technical and organisational measures. This assessment is made before signing and must be documented: compliance questionnaire, description of security measures, data location, incident management policy, any use of sub-processors.

A recognised certification or adherence to an approved code of conduct (Articles 40 to 42) is a useful factor in the assessment. It does not, however, amount to a conclusive presumption of compliance: it informs the choice without removing the need for checks.

The audit clause in the data processing agreement

Document-based audit and compliance questionnaire

The most common form relies on the provision of documents: record of processing activities, security policy, existing audit reports, certificates, security assurance plan. Article 28(3)(f) also requires the processor to assist the controller in ensuring compliance with the obligations under Articles 32 to 36, which includes providing the relevant information.

On-site inspections and audits

Where the sensitivity of the processing justifies it, the audit may take the form of an inspection, conducted by the controller or by a mandated third party. The contract should specify the notice period, confidentiality, scope, frequency and allocation of costs. These terms are not set by law: they are negotiated and must be proportionate to the risk.

Do not forget the chain of sub-processors

The use of a sub-processor is governed by Articles 28(2) and 28(4): it requires the controller’s authorisation and the same data protection obligations to be passed down. An audit loses its meaning if it stops at the first provider: you must be able to trace the chain, at least through documentation, all the way to the parties that actually host or process the data.

In practice: building a proportionate audit framework

• Keep an up-to-date map of processors and their sub-processors.
• Set different levels of control according to risk: a questionnaire for routine processing, an on-site audit for sensitive processing.
• Keep a record of audits carried out and of remediation action plans.
• Provide for the contractual consequences of an identified breach (formal notice, suspension, termination).
• Link the audit to the reversibility clause and to what happens to the data at the end of the contract.

Points to watch

• An audit right that is never exercised weakens the demonstration of compliance: regular use matters as much as the clause.
• A provider’s certification does not necessarily cover the exact scope of the processing entrusted to it.
• A processor’s persistent refusal to undergo an audit is a contractual warning sign to anticipate from the negotiation stage.
• The audit must respect the rights of third parties and the confidentiality of the processor’s other clients.

When should you consult a lawyer?

A lawyer’s involvement is useful to draft an audit clause that actually works, to calibrate the data processing agreement and to structure a defensible monitoring framework. Where the compliance management function is in-house, it is coordinated with support for the Data Protection Officer. More broadly, these checks form part of a GDPR compliance programme.

The analysis must be carried out case by case: the solution depends on the facts, the drafting of the contract and the nature of the processing concerned.

What the law says

The right to audit a processor derives directly from the GDPR. The controller “shall use only processors providing sufficient guarantees” (Article 28(1)). Above all, the data processing agreement must stipulate that the processor “makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections” (Article 28(3)(h)).

Official sources

• Article 28 of the GDPR (Regulation (EU) 2016/679), processor: CNIL (in French)

Every situation is different. To frame a processor audit or make your GDPR contracts legally sound, our data protection lawyers assist you.

For assistance: data processing agreement lawyer.