Conducting a GDPR Data Audit

Complying with the EU General Data Protection Regulation (GDPR) means taking control of every piece of personal data in your company. This may sound like an impossible task, but it's not as daunting as it might seem.

Your first step toward compliance should be conducting a data audit. You should take a systematic approach to discovering all the different ways personal data flows in and out of your company.

You may be surprised at how much personal data you have in your possession that you don't actually need. And you might even find that you're holding some personal data unlawfully.

What is a Data Audit?

A data audit involves determining exactly how your organization processes personal data. It will help you understand:

• What personal data you're processing
• How you're processing it
• Whether you need to process it
• Whether you're processing it lawfully

You might find a lot of personal data skeletons in the closet. Or you might realize that you're already doing everything perfectly well as it is. Either way, you need to take control of this aspect of your organization.

Do I Really Need to Conduct a Data Audit?

A data audit is the only way that you can truly know that you're complying with data protection laws.

For example, the GDPR only allows personal data to be processed on one of six lawful bases. If you haven't considered which of the lawful bases you relied on when you obtained a given piece of personal data, you may be storing it unlawfully.

And then there are the six principles of data processing. The GDPR requires you to apply these principles at all times when working with personal data. If you're keeping personal data for longer than you need it, or collecting more personal data than you need, then you could be breaking the law.

And remember that the GDPR brought many changes when it came into force in May 2018. If you haven't reviewed your practices since the new law came into force, you may be complying with outdated rules.

Does the GDPR Require a Data Audit?

There's no specific article in the GDPR stating that an organization must conduct a data audit. But there's really no way to comply with any given part of the Regulation without knowing what personal data your company is processing.

The collecting, storing and transferring of personal data are legally-regulated acts. That might mean:

• Receiving someone's email address via a web form
• Storing that email address in a Word document
• Emailing the Word document to a colleague

You need a lawful justification for doing any of these things.

What Sort of Data Am I Looking For?

Personal data is a very broad term, and you might be surprised how much it covers. Equally, there are some misunderstandings in the other direction - not all data is personal data.

The GDPR defines personal data as "any information relating to an identified or identifiable natural person."

Think of this as any information which might, directly or indirectly, lead to the identification of a natural person ("natural person" is an individual, rather than a "legal person" like a corporation). This includes your customers, employees, clients, and anyone else who comes into contact with your company.

Think beyond the obvious things such as a person's name and contact details.

• Recordings of a person's voice could be personal data, even if they aren't talking about themselves
• Information about a person's internet activity could be personal data, even if they haven't Googled their own name
• Data on a person's movements could be personal data, even if they haven't visited their own home

All of these examples (biometric data, cookie data, location data) can be personal data under the GDPR, and you need to be aware of how you're processing them.

"Processing," by the way, basically means doing something to personal data. This includes collecting, receiving, storing, and transferring it.

Mapping Your Data

A data audit should not be that hard if you approach it in an organized and systematic way. First, you need to "map" all the personal data your company processes.

Sources of Personal Data

Before you consider what types of personal data your company holds, it's worth considering how personal data flows into your systems in the first place.

Here are some examples of possible entry points:

Notice how porous your company's "borders" can be. You might be gathering personal data in some ways without even realizing.

Locations of Personal Data

Now it's time to think about where personal data might be stored within your company.

Note that, again, we're carrying out this step before listing the types of personal data you hold. This is because thinking about the various potential locations of personal data within your company's infrastructure will prompt you to consider all the different types of data that might be present there.

Here are some possible locations:

Personal data can hide in all sorts of unexpected places. Leave no stone unturned!

Types of Personal Data

We've considered the broad definition of personal data above. Now it's time to apply this to your company.

With reference to the entry and storage points you've identified above, consider all the different types of personal data that enter your systems.

It's not possible to create an exhaustive list of the types of personal data. Here are some examples of information that can qualify:

Note that many of these types of data might only be "personal" in certain contexts, ie where they relate, directly or indirectly, to an individual person.

Getting Compliant

By this point in the audit, you should know what personal data is processed by your company. Now you can determine whether you're GDPR compliant. This will allow you to cull unnecessary and unlawful personal data.

Purposes for Processing

The GDPR's principle of purpose limitation requires that you only process personal data in connection with a specified purpose. You need a good reason to collect and store each item of personal data in your possession.

And the principle of data minimization requires that the amount of data you process must be limited to what is necessary.

Applying these two principles will require you to determine the purpose for which you're processing each item of personal data, and then erase any personal data you don't need in connection with a specific purpose.

Some purposes for which you might be processing personal data include:

If you don't need to process personal data in connection with a specific purpose, you're under an obligation not to do so. It's also likely to be a waste of resources.

Lawful Bases for Processing

If you are processing personal data without an appropriate lawful basis, you'll be in contravention of the GDPR.

You must make sure that you are processing all the personal data in your possession on one of the following lawful bases:

If you don't have a lawful basis for processing personal data in a particular way, you must stop.

Storage Periods

Another important principle of the GDPR is storage limitation. You must not store personal data for longer than you need it. And why would you? Accumulating more and more personal data is a recipe for a data breach.

It's a good idea to draw up a retention schedule. This serves as a guide to how long certain types of personal data are stored within your company.

Think of the storage period as a ticking clock. Different types of personal data will have different "trigger" events which start the clock ticking. The clock will tick for differing amounts of time for different types of personal data. Once the clock stops ticking, the data must be erased or reviewed.

For example:

In certain sectors there will be a legal obligation to retain certain types of personal data for a predetermined period. You may also be able to justify retaining customer or client correspondence for quite a long time in case you need to defend against a potential legal claim.

Once you have decided on an appropriate storage period for various types of personal data, you can erase any old and unnecessary personal data in your possession.

Summary

What we've covered here should give you a good overview of what personal data is entering your company.

Data protection is highly context-specific. Depending on the nature of your business, you may need to consider other things, too. For example, the contracts you have in place with other companies who receive personal data from you, or how you manage personal data belonging to children.

Here's a simple data audit template that covers the points we've raised above, filled in with an example to show you how to fill out each field. You can expand on this to include further information that might be relevant to your sector. And remember that you may need more detailed records for certain purposes, such as a retention schedule.