Data Protection Audit and Certification

privASSIST is a web-based audit tool that can be used to “query” your company's data protection. The aim is to find out whether you are working in compliance with the GDPR and to certify this status. Instead of employing data protection auditors on site, you can conveniently carry out privASSIST online using a customized questionnaire based on your company's requirements, size, and type of data processing. The questionnaire is based on the Certified Privacy Standards (CPS), which are evaluated within one to two weeks after the questions have been successfully answered.

The result of the data protection audit provides you with a detailed evaluation and clear comparisons with the existing database and, if necessary, also offers insights into deviations and potential for improvement. A successful data protection audit is certified according to the standards of IITR Cert GmbH.

A data protection audit with privASSIST offers you the following advantages:

• Questionnaire: You are guided through the questions in easy-to-understand language, and your answers are recorded in an audit-proof manner.
• Standardized certificates: privASSIST is based on testing and certification standards (CPS), according to which data protection is queried and evaluated.
• Comprehensive audit report: With privASSIST, the current data protection standard is transparently verified.
• Cost-effective: Thanks to online testing procedures, costs can be kept low compared to an on-site audit, ranging from €225 to €2,000.

A data protection audit can be carried out internally and on site by the data protection officer or by an external data protection officer or data protection auditor. Contact points for external service providers include TÜV or audit companies. Web tools such as privASSIST are an alternative to on-site data protection audits.

Tip: When selecting a data protection auditor or audit tool, always make sure that you are dealing with a reputable provider who presents the audit process and certification in a transparent manner. External auditors or web-based tools are preferable to internal auditors because they are unbiased and deliver objective results.

Article 32 (Security of processing) of the General Data Protection Regulation (GDPR) stipulates that data protection must be ensured in companies through specific measures:

d) a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of processing. (Art. 32 GDPR)

A data protection audit examines the extent to which companies comply with data protection requirements and operate in accordance with the GDPR. A data protection audit can also reveal options for improving data protection processes in your company.

A data protection audit allows you to check whether the requirements of the GDPR are being met and whether the handling of data within your company is up to date in terms of data protection law. A data protection audit identifies areas where data protection processes can be optimized and, upon successful completion and certification, provides you with proof for customers and authorities. A data protection audit is important if you process personal data within your company or if you collect personal data on behalf of another company—in other words, a data protection analysis is essential for virtually all companies and providers.

Do you process personal data within your company or offer this service to other companies? Then you must work in compliance with the GDPR. A data protection audit can provide evidence of data protection-compliant services, processes, and structures within a company. A data protection analysis is therefore recommended for all companies, including small and medium-sized enterprises (SMEs) that handle personal data.

As a general rule, web-based data protection audits such as privASSIST are cheaper than on-site data protection audits. With privASSIST, you can expect to pay between €225 and €2,000, whereas an on-site data protection audit can cost this amount per day over several days.

The duration of a data protection audit depends on the type of data collection. An on-site data protection audit can take several days, plus some time to evaluate the results. With privASSIST, you only need to spend about half a day (depending on the selected audit catalog) answering the questions. You can expect to receive the results of the data protection analysis after one to two weeks.

It is not possible to make a general statement about how often a data protection audit should be carried out. Nevertheless, you should repeat data protection audits regularly or carry out supplementary analyses annually to check whether all data protection regulations are being complied with.

After a data protection audit, whether internal or external, a report should always be written, known as the audit report. Within the privASSIST audit report, the results are presented in an easy-to-understand graphical format, giving you an overview of the current state of data protection in your company. Based on this, a list of measures can be created that lists the weaknesses in your data protection and adds to-dos for remedying them.

Do you have any questions or would you like to have a data protection audit carried out with privASSIST? Then find out more now about data protection audits and certification from IITR Cert GmbH.

Yes, privASSIST has an English-language version that allows you to perform a data protection audit using English-language auditing standards.

privASSIST provides users and companies seeking certification with a comprehensive list of questions. This checklist is used to verify compliance with data protection standards. The specific questions depend on the respective Certified Privacy Standard (conformity assessment), which is based on the size of the company and the type of data processing.

The topics covered by privASSIST include (among others):

• Data protection organization
• Data protection documentation
• Data security

The following questions may be part of the questionnaire (selection):

• Is there a data protection officer (if necessary)?
• Are there access controls for the business premises/server room?
• How are any data protection violations dealt with?

Article 42 of the General Data Protection Regulation provides for certification when companies have personal data processed or collect and process it themselves on behalf of others. With the privASSIST tool, private-law certification is carried out by IITR Cert GmbH in accordance with the Certified Privacy Standard (CPS). Your data protection audit can be certified according to the following standards:

• CPS 100: Certification of data protection status for medium-sized companies
• CPS 300: Certification of processors in accordance with Art. 28 GDPR
• CPS 600: Certification of data protection status for small companies