5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Data protection audit for companies
A folder of documents is not yet evidence.
We check whether documentation, tools, service providers, data flows and processes in your company fit together and provide a prioritised basis for your decisions.
Please enter a short description first.
The first contact is free of charge. You will receive an explicit notice before any costs arise.
Response within 24 hours on working days
As of: 23 October 2026
Audit findings: where does practice match documentation?2 of 6
- RoPA reflects current processingNew CRM missingCheck
- DPAs with all service providersSupport access from a third countryMissing
- Privacy notices up to datePresent
- Erasure periods implemented technicallyMissing
- Process for access requestsPresent
- DPIA for profiling reviewedCheck
Priority: Close third-country access without a contract first
- 1Describe the occasionCustomer, investor, review
- 2Define the scopeFull or by area
- 3Receive the resultFindings and measures
Schematic illustration of audit findings. Simplified example.
We audit for
- Mid-sized companies
- Software and SaaS
- Online retail
- Corporate groups
Key points at a glance
- A data protection audit checks whether a company's documents, systems, contracts, data flows and actual processes fit together.
- The GDPR does not prescribe an audit in a fixed format, but under Art. 5(2) and Art. 24 GDPR companies must be able to demonstrate compliance.
- At ITMR, we deliver audit findings, a risk assessment and an action plan in a sensible order.
- We align the scope with the occasion.
- Your contact is Dominik Skornia and his team. He is an AI Privacy Expert (GDDcert. EU). Response on working days within 24 hours.
- VVT
- Record of processing activities under Art. 30 GDPR. It lists which data is processed for which purpose.
- AVV
- Data processing agreement under Art. 28 GDPR. It governs how a service provider processes data on your behalf.
- DSFA
- Data protection impact assessment under Art. 35 GDPR. It assesses the risks of a processing operation before it starts.
- SaaS
- Software as a Service. Software used over the internet rather than installed.
Triggers
When is a data protection audit worthwhile?
An audit becomes relevant when you need to explain data protection robustly to customers, investors, management, data protection officers or authorities.
We review how the documents work together, not the individual file.
What matters is not whether individual documents exist. We check whether documents, systems, contracts, data flows and actual processes form a consistent line.
The audit reviews the status as actually lived. It is narrower than general advice on data protection law and broader than a review of a RoPA, DPA, DPIA or proceedings before an authority.
In our experience, digital business models bring together data protection, IT contracts, cloud, product development, marketing, HR, security, AI features and international data flows. The audit shows what is robust, what needs to be followed up and where a specialist review makes more sense.
- For whom
- Companies under pressure to provide data protection evidence
- Result
- Findings, risk assessment, action plan
- Scope
- Full audit or individual areas
- Legal basis
- Accountability under Art. 5(2) and Art. 24 GDPR
Suitable scope of review
Describe the occasion in the form. We will get back to you on working days within 24 hours with a proposed scope.
How it works
How does the audit work in three steps?
We agree the scope and timetable with you before we start.
01
Describe the occasion You tell us why the audit is due: customer, investor, internal review, tool change, relaunch, growth, a note from the data protection officer, contact with an authority or an incident.
02
Define the scope We clarify whether a full audit, a review of individual areas or a specialist review such as RoPA, DPA, DPIA or data protection set-up fits better.
03
Receive the result You receive a legally prioritised assessment with risks, gaps in evidence and an order for implementation.
How we approach the audit
- 1
Occasion and scope We clarify the pressure: customer audit, due diligence, a management decision, tools, a note from the data protection officer or contact with an authority.
- 2
Compare documents and practice We check RoPA, DPAs, privacy notices, technical measures, the list of tools and service providers, the erasure concept and the practice of the business units for consistency.
- 3
Prioritise risks We separate legal risks, gaps in evidence, operational weak points and documentation items that can be followed up in an orderly way.
- 4
Define measures The result shows what must be closed first before an audit, customer response, decision or approval, and which specialist review follows.
How long does it take? We complete most work steps within a few working days. How quickly it goes depends on the scope and your feedback. Do you have a fixed date, such as a launch? Tell us right away in your enquiry and we will plan for it.
Service package
What do we deliver in the data protection audit?
Service package: data protection audit
Audit findings A clear assessment of whether documents, processes, tools, service providers, legal bases and actual processing fit together.
Risk assessment Prioritisation by legal relevance, pressure to provide evidence, urgency and controllability.
Action plan Next steps for documentation, contracts, processes, responsibilities, technical measures and specialist reviews.
Results for every level Priorities for management, a line for legal and data protection and concrete points for IT, product and business units.
- For whom
- Companies and organisations of all sizes
- First response
- within 24 hours on working days
- Costs
- We tell you the costs transparently before you instruct us.
- Not included
- Implementation of measures, new contracts and proceedings before authorities. These are separate services, on request.
Who delivers what and who decides
- Occasion and goal
- Existing documents
- Access to contacts
- List of tools and service providers
- Definition of scope
- Comparison of documents and practice
- Risk assessment
- Action plan
- Your management decides on measures and order
- The business units decide on day-to-day implementation
How does the engagement work?
- 1
First assessment You describe the occasion using the form. We propose a suitable scope. The first contact is free of charge.
- 2
Offer Before we start work, we tell you the scope and costs of the audit transparently.
- 3
Court steps separately If you wish, we agree the implementation of individual measures, court proceedings and representation before authorities separately.
Typical occasions
What occasions lead to an audit?
These are the four situations we see most often in our mandates.
A major customer, investor, group partner, platform operator or audit team asks for documents, technical measures, DPAs, erasure, roles and responsibilities.
Legal, IT, the data protection officer, management and business units assess the same status differently.
CRM, HR software, web analytics, newsletters, cloud, SaaS, AI features or support access arrived faster than documentation and contracts.
A relaunch, acquisition, due diligence, internationalisation, data subject request, incident or contact with an authority shows a need for clarification.
Areas of review
Which areas does the audit bring together?
We uncover contradictions between documentation and practice. That is where the risks arise that are hard to explain in customer audits, contact with authorities or due diligence.
Which data run through which systems, who decides on purposes and means, which service providers are involved and is the allocation of roles legally tenable?
Do consent, contract, legitimate interest, legal obligation or employee data protection support the processing, and are the purposes clearly defined?
Does the record reflect actual processing, or does it contain legacy content that can no longer be explained when questions arise?
Do contracts, annexes on technical measures, sub-processors, third-country transfers, support access and the service description fit together?
Are safeguards, permissions, erasure, logging, encryption and incident processes only described, or can they be controlled in everyday work?
Can your company answer access, erasure, objection, a data breach, customer or authority questions consistently?
Risk picture
Which weak points do we find most often in audits?
We check these points in every audit.
- Outdated privacy notices They do not name the tools, recipients, purposes or storage periods actually used.
Rough or outdated RoPA The record is not aligned with contracts, service providers and technical processes.Unsuitable DPAs Contracts exist but do not fit sub-processors, support access, hosting, the main contract or technical measures.Deletion periods only on paper Periods are documented but not implemented technically or organisationally.
Different assumptions Marketing, sales, HR, product and IT use data based on different assumptions.Data flows not updated After a tool change, group support or cloud use, the review and contract for international transfers are missing.No prepared process Data subject rights and incidents are only handled under pressure.DPIA recognised too late High-risk processing is not reviewed before approval.
Results per level
What does the audit deliver for each area?
We translate the findings into concrete decisions for every level in the company.
Clear priorities instead of vague GDPR risks. You see which gaps are relevant for liability, customers or supervision and which measures you should decide on first.
A robust line for documentation, contracts, roles, data protection processes, internal approvals and evidence towards customers, investors and authorities.
Concrete notes on which topics around tools, data, permissions, erasure or service providers need tightening before approval or continued operation.
Audit decision
Which review fits your situation?
If the bottleneck is clear, a specialist review reaches the goal faster.
| Starting point | Suitable review | Typical result |
|---|---|---|
| Documents grown over time, several tools, unclear priorities | Data protection audit | Findings, risk assessment, action plan |
| New product, website, shop, app or SaaS before launch | Data protection set-up | Approval, obligations, follow-up measures |
| Single processing operation with high risk | Data protection impact assessment | DPIA obligation, risk assessment, measures |
| Service providers, cloud, sub-processors, support access from third countries | Review of DPAs and transfers | Risk list, negotiation line, approval recommendation |
| Authority, complaint, hearing or deadline | Help with the data protection authority | Facts, statement, defence |
Legal framework
What is a data protection audit legally based on?
Under Art. 5(2) GDPR, the controller must be able to demonstrate compliance with the principles. Art. 24 GDPR requires appropriate technical and organisational measures and their review where necessary.
The subjects of review follow from the Regulation: the record under Art. 30, processing on behalf under Art. 28, security under Art. 32 and the impact assessment under Art. 35 GDPR.
Art. 32(1)(d) GDPR expressly mentions a process for regularly testing and evaluating the effectiveness of security measures.
An audit does not replace a data protection impact assessment. But it can show that such a review is required under Art. 35 GDPR.
- General Data Protection Regulation (EUR-Lex) Principles, accountability, processing on behalf, security and DPIA.
- EDPB Guidelines 4/2019 on data protection by design Guidance when processes and systems have to be designed in a privacy-friendly way.
- Short papers of the German Data Protection Conference Interpretation aids from the German supervisory authorities on core GDPR topics.
- BfDI on data protection impact assessments Notes when individual processing operations need in-depth review.
Limits
What does an audit not do?
The audit is a basis for decisions. Implementation follows afterwards.
- 1
No certification The audit is a legal review by lawyers and not a certification under Art. 42 GDPR.
- 2
No technical security test Penetration tests and technical vulnerability analyses are carried out by specialist service providers. We assess their results legally.
- 3
No DPIA If the audit reveals a high risk, a separate impact assessment follows.
Mistakes that undermine an audit
- The scope does not fit the occasion.
- Only documents are reviewed, not actual practice.
- The list of deficiencies has no priorities.
- Nobody is responsible for implementation.
Your contact
Lawyer · AI-Privacy-Expert (GDDcert. EU) · External data protection officer
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title of specialist lawyer for information technology law.
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“Mr Skornia took a lot of time and answered the questions on the GDPR rules in detail, competently and clearly. Happy to come back!” (translated from German)
“Competent advice, fast handling, all deadlines met, always reachable. And the most important point for me: everything was handled with determination!” (translated from German)
“Mr Bohne is an excellent lawyer. He really took his time, listened attentively and gave me clear recommendations on how to set up my app in Germany in a GDPR-compliant way, including tips on typical pitfalls.” (translated from German)
FAQ
What do companies ask about the data protection audit?
When does a data protection audit make sense?
When you are not sure whether documents, processes, tools and actual processing still fit together. Typical occasions are customer audits, investor questions, tool changes, growth, contact with authorities or an incident.
Is a data protection audit required by law?
The GDPR does not prescribe an audit in a fixed format. However, under Art. 5(2) GDPR you must be able to demonstrate compliance, and Art. 32 GDPR requires security measures to be reviewed regularly.
What is the difference between an audit and a data protection set-up?
The audit reviews the existing status and prioritises risks. The set-up builds structures, responsibilities, documents and processes from scratch. The audit shows whether targeted rework is enough.
What is the difference between an audit and a RoPA review?
The RoPA review only concerns the record. The audit also covers legal bases, service providers, DPAs, technical measures, erasure, data subject rights, privacy notices and processes.
Can the audit be limited to individual areas?
Yes. We can focus on website and marketing, HR, SaaS, service providers, international data flows, CRM, AI or individual business areas. The scope must answer the occasion.
Which documents help with the enquiry?
RoPA, DPAs, privacy notices, technical measures, list of tools and service providers, erasure concept, process descriptions, customer questionnaires and a short description of the occasion.
Does an audit replace a data protection impact assessment?
No. The DPIA is a separate in-depth review for processing likely to result in a high risk. The audit can show that one is needed.
What happens after the audit?
You know which risks to close first, which documents need adjusting, which responsibilities are missing and which specialist review follows.
Next step
Does your data protection have to withstand a review?
Describe the occasion, the systems concerned and existing documents. We will propose the right starting point.
Helpful for your enquiry
- Occasion of the audit
- Systems and areas concerned
- List of existing documents
- Customer questionnaire, if available
You can also submit documents after our first response.
Request a data protection audit
Briefly describe the occasion of the audit. We will propose a suitable scope of review.
Helpful are the occasion, the systems and processes concerned and a list of existing documents.
Related services
Data protection law Framework for GDPR, data subject rights and data protection organisation.record of processing activities When the RoPA is the bottleneck.Data processing agreement Service providers, cloud and sub-processors.data protection impact assessment High-risk processing before approval.data protection set-up Build data protection organisation from scratch.Help with the supervisory authority When a letter or deadline has already arrived.External data protection officer Appoint an external DPO.Data protection training Train your teams.
From our blog: GDPR fines · GDPR cease-and-desist letters from associations and competitors