Beyond the Audit Notice: What Organisations Should Know About Mandatory Data Protection Audits  

An audit notice can often create uncertainty.

For many organisations, the word audit brings thoughts of scrutiny, compliance gaps, and the fear of getting something wrong. But what if an audit is not about finding fault? What if it is an opportunity to understand where an organisation stands and strengthen the systems that protect personal data?

This was a key message from the Office of the Data Protection Commissioner’s (ODPC) preparatory session held on 10 September 2026 with accredited audit firms authorised to conduct data protection audits.

The session brought together firms recognised by the ODPC as representatives and ambassadors of the Office to prepare auditors for upcoming audits, reflect on lessons from previous assessments, and enhance the quality of future audit engagements.

A key takeaway was clear: audits are not intended to punish organisations. They are intended to support accountability, improvement, and stronger data protection practices.

The ODPC emphasised that effective audits must go beyond checking whether policies exist. Auditors are expected to examine the methodology, tools, techniques, and evidence behind organisational practices.

For instance, in a healthcare environment, it is not enough for an auditor to confirm that laboratory tests are conducted. A meaningful assessment considers the tools used, the techniques applied, the controls supporting the process, and how samples are selected. The goal is to understand whether systems work effectively, not simply whether they exist.

As organisations prepare for audits, they should expect assessments around key areas such as staff training, security safeguards, record management, handling of data subject requests, data sharing practices, third-party relationships, cross-border transfers, and governance structures.

Training remains a critical area of focus. As highlighted during the session, “A company is only as good as the least trained staff.” Organisations should therefore be prepared to demonstrate evidence of staff awareness and training rather than relying only on verbal confirmation.

The ODPC also addressed concerns around Data Protection Impact Assessments (DPIAs). Some organisations may hesitate to conduct DPIAs due to concerns about sharing information regarding upcoming projects. The Office reassured organisations that information submitted through DPIA processes is handled within the legal framework governing the regulator.

A DPIA should therefore be viewed as a proactive tool that helps organisations identify risks early, strengthen safeguards, and build trust before launching new initiatives.

The session also highlighted the importance of accountability and governance. Effective data protection requires more than policies stored away. It requires clear responsibilities, updated records, appropriate oversight, and strong leadership commitment.

The ODPC emphasised the importance of effective Data Protection Officer (DPO) structures and recommended that DPO roles ideally sit within risk or compliance functions to minimise conflicts of interest.

Beyond processes and documentation, the success of an audit depends on openness. The audit process was likened to a doctor-patient relationship. Just as a doctor can only provide the right treatment when a patient is honest about their condition, auditors can only provide meaningful recommendations when organisations openly share their challenges.

An audit report should therefore not be viewed as the end of the process. Organisations are expected to act on recommendations, and the ODPC may follow up after agreed timelines to assess progress.

As mandatory audits continue, organisations should not wait until an audit notice arrives to review their practices. Preparation is not simply about being ready for assessment. It is about building a culture where protecting personal data becomes part of everyday operations.

Because behind every record, every system, and every security measure is a person who has entrusted an organisation with something deeply personal, their information.

An audit is not a search for failure. It is an opportunity to demonstrate responsibility, strengthen compliance, and build trust.

Because in the end, data protection has never been about passing an audit.It has always been about protecting people.