# DPA Inspection Preparation Standards Reference

## Legal Basis for DPA Inspections

### GDPR Art. 58(1) — Investigative Powers
- **(a)**: Order controller/processor to provide information for DPA tasks
- **(b)**: Carry out investigations in the form of data protection audits
- **(c)**: Review certifications issued pursuant to Art. 42(7)
- **(d)**: Notify controller/processor of alleged infringement
- **(e)**: Obtain access to all personal data and information necessary
- **(f)**: Obtain access to premises, including data processing equipment

### GDPR Art. 58(2) — Corrective Powers
- **(a)**: Issue warnings
- **(b)**: Issue reprimands
- **(c)**: Order compliance with data subject requests
- **(d)**: Order processing operations to conform with GDPR
- **(e)**: Order communication of breach to data subjects
- **(f)**: Impose temporary or permanent processing ban
- **(g)**: Order rectification, restriction, or erasure per Art. 16-18, 21
- **(h)**: Withdraw certification
- **(i)**: Impose administrative fine per Art. 83
- **(j)**: Order suspension of data flows to third country

### GDPR Art. 31 — Cooperation with Supervisory Authority
- Controller and processor shall cooperate with the supervisory authority in the performance of its tasks
- Failure to cooperate: infringement subject to Art. 83(5)(e) fines (up to EUR 20M / 4%)

## DPA Inspection Practices by Authority

| DPA | Inspection Approach | Notable Practices |
|-----|-------------------|-------------------|
| CNIL (France) | On-site (announced/unannounced), online, document-based | 340+ controls annually; sector-focused campaigns |
| ICO (UK) | Consensual audit, compulsory audit, assessment | Published audit methodology; risk-based selection |
| AEPD (Spain) | Inspection plans, complaint-triggered, sector sweeps | Annual inspection plans published |
| BfDI (Germany) | Written inquiries, on-site inspections, technical audits | Focus on federal public bodies and telecoms |
| Garante (Italy) | Inspections delegated to Guardia di Finanza | 150+ inspections annually |
| DPC (Ireland) | Inquiries (own-volition and complaint-based) | Large-scale inquiries into tech companies |

## Key Publications
- EDPB Guidelines on Administrative Fines (WP253)
- CNIL Inspection Methodology Guide (CNIL, published)
- ICO Audit Programme methodology (ICO, published)
- AEPD Annual Inspection Plan (AEPD, published annually)