Contents
Since the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) entered into application in May 2018, every company that processes personal data of natural persons has been obliged to demonstrate compliance with the Regulation. This is the so-called accountability principle, laid down in Art. 5(2) GDPR.
In Bulgaria this principle is further regulated by the Personal Data Protection Act (PDPA), substantially amended in 2019. The Commission for Personal Data Protection (CPDP) is the supervisory authority with powers to carry out inspections and impose sanctions.
Important: The GDPR audit is the main instrument through which a company demonstrates compliance before the CPDP and the supervisory authorities.
What a GDPR audit is and why it is needed
A GDPR audit is an independent and systematic review that assesses the extent to which an organisation complies with the requirements of Regulation (EU) 2016/679 and national legislation. It covers a review of the documentation, the technical security measures, the organisational procedures and the actual practices.
Under Art. 5(2) GDPR, the controller is responsible for compliance with the core principles and must be able to demonstrate its compliance. The audit is the main instrument for doing so.
Case law The Court of Justice of the EU confirmed in Case C-60/22 that failure to comply with documentation requirements (Art. 26 and Art. 30 GDPR) may constitute an infringement of the accountability principle when read in conjunction with Art. 5(1)(a) GDPR.
Who needs a GDPR audit
In practice, every company that processes personal data needs an audit – including micro-enterprises and sole traders. An audit is particularly important for:
- Companies with customers in the EU – e-commerce, cloud platforms (SaaS), mobile applications
- Companies obliged to maintain a record of processing activities (Art. 30 GDPR)
- Organisations processing special categories of data – health, biometric, genetic (Art. 9 GDPR)
- Companies using AI, profiling or automated decision-making
The steps of a GDPR audit
1. Mapping personal data
Identifying all categories of data – from customers’ names and e-mail addresses to employee data, IP addresses and cookies. The CPDP recommends this stage as the second step in its guide “Ten practical steps for implementing the GDPR”.
2. Review of the legal basis
For every processing activity there must be a valid legal basis under Art. 6(1) GDPR: consent, contract, legal obligation, vital interests, public interest or legitimate interest.
3. Documentation review
ROPA register
Record of processing activities (ROPA) under Art. 30 GDPR
Privacy Policy
Privacy policy – in accordance with Art. 13 and Art. 14 GDPR
DPA contracts
Contracts with processors of personal data under Art. 28 GDPR.
DPIA assessments
Impact assessment for high-risk processing.
4. Technical and organisational measures
Under Art. 32 GDPR the following are checked: encryption, access management, 2FA, employee training and incident response procedures.
5. Review of data subject rights
It is checked whether the company has procedures for responding to requests under Art. 15–21 GDPR within one month (Art. 12(3) GDPR).
6. Review of contracts with subcontractors
Under Art. 28 GDPR, any processing on behalf of the controller must be governed by a DPA that clearly sets out the subject-matter, duration, nature and purpose of the processing.
Sanctions and fines
Non-compliance with the GDPR can lead to serious financial and reputational consequences.
Less serious infringements
Up to EUR 10 million or 2% of turnover.
Serious infringements
Up to EUR 20 million or 4% of global turnover.
CPDP practice
Significant sanctions against the NRA and DSK Bank.
Reputational risk
Loss of trust, customers and business partners.
Important: In Bulgaria the CPDP has imposed significant sanctions – BGN 5.1 million on the National Revenue Agency (NRA) (reduced by the Supreme Administrative Court with Decision No. 8694/2021) and BGN 1 million on DSK Bank. For 2024, the total amount of fines is according to indicative CPDP data (see the annual report for 2024)
How often an audit should be carried out
Good practice recommends at least once a year, as well as whenever there is a significant change – a new IT system, a new supplier, a new type of processing or an incident. It is advisable for the audit to be performed by an external specialist for objectivity.
Frequently asked questions
What is a GDPR audit?
A systematic review of the company’s compliance with Regulation (EU) 2016/679 and the PDPA.
How often should it be done?
It is advisable at least once a year, as well as whenever there are significant changes in the business.
What are the fines for non-compliance with the GDPR?
Up to EUR 20 million or 4% of annual global turnover under Art. 83 GDPR.
