AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor controllers, processors and DPOs that handle personal data of people in the EU and must show a supervisory authority how they meet the Regulation.
30-day trialUnlimited free viewersNo credit card required
Checked against primary sources on 18 October 2026.
Controllers and processors established in the EU, and those outside it that offer goods or services to, or monitor the behavior of, people in the EU.
National data protection supervisory authorities, through complaints, breach notifications, investigations and audits; in the UK, the ICO under the UK GDPR.
No fixed audit cycle; records of processing and other evidence must be produced on request, and breaches are documented as they occur
Regulation (EU) 2016/679 as published in OJ L 119, 4.5.2016 (EUR-Lex shows no later consolidated version), 2016-04-27 (applies from 2018-05-25). Free to read.
| Date | What happens | Status |
|---|---|---|
| 2026-01-01 | Regulation (EU) 2025/2518 on GDPR cross-border enforcement procedure enters into force | Done |
| 2026-06-19 | UK: ICO states all data protection provisions of the Data (Use and Access) Act 2025 are in force | Done |
| 2027-04-02 | Regulation (EU) 2025/2518 applies | Scheduled |
Each one needs an owner, an approval, and proof it reached the people it covers.
Article 24(1) and 24(2)
The controller implements measures to ensure and demonstrate compliance, including appropriate data protection policies where proportionate to the processing.
Article 30
Controllers and processors keep written records of processing, electronic form included, and make them available to the supervisory authority on request.
Article 32(1) and 32(4)
Appropriate technical and organizational measures protect personal data, and anyone acting under the controller's or processor's authority processes it only on instructions.
Article 33(5)
Every personal data breach is documented with its facts, effects and remedial action, so the supervisory authority can verify compliance.
Article 35
Before processing likely to result in high risk to individuals, the controller assesses its impact on the protection of personal data.
Article 39(1)(b)
Where a DPO is designated, they monitor compliance with the GDPR and internal policies, including assignment of responsibilities, staff awareness and training, and related audits.
Citations are to the standard or regulation; wording is ours.
What reviewers sample about these documents and the people they cover.
Authorities typically ask for the Article 30 record first, then test whether it reflects actual processing, recipients, transfers and retention.
Investigators request data protection policies and evidence they were approved, communicated and applied, under Articles 5(2) and 24.
After an incident, authorities ask for the internal breach documentation required by Article 33(5), including breaches that were never notified.
They ask how staff were told about policies and instructions, often through DPO monitoring records and training logs.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Need help with the rest of GDPR? Find a consultant for your standard (opens in a new tab).
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
Article 30(5) exempts organizations with fewer than 250 employees only where processing is occasional, unlikely to create risk and excludes special category or criminal offense data. Routine employee or customer processing usually falls outside it.
A 2025 Commission simplification proposal would widen the Article 30(5) exemption to organizations with fewer than 750 employees, except where processing is likely to be high risk. The EDPB and EDPS issued a joint opinion in July 2025, and the proposal was still in the legislative process as of October 2026.
It sets common procedural rules for how supervisory authorities handle cross-border complaints and investigations, including admissibility and the right to be heard. It applies from 2 April 2027 and works alongside the GDPR's existing documentation duties.
The UK GDPR keeps the same accountability, records and security articles, read with the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025. The ICO states all DUAA data protection provisions were in force by 19 June 2026, including a duty to acknowledge data protection complaints within 30 days.
The GDPR does not prescribe signatures. Controllers must be able to demonstrate compliance under Article 5(2), so dated records of who received which policy and training are a common form of evidence.
Industries that hear about GDPR most.
free for 30 days