# Regulatory Standards — Vendor Privacy Audit

## Primary Regulations

### GDPR — Regulation (EU) 2016/679

- **Article 28(3)(h)**: "The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller." This is the foundational audit right provision.

- **Article 5(2)**: The accountability principle requires controllers to demonstrate compliance. Processor audits are a key accountability mechanism.

- **Article 24(1)**: The controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with the GDPR. Regular vendor audits serve this obligation.

- **Article 32**: Security of processing. Audits verify that processors have implemented and maintain the security measures specified in the DPA.

- **Article 58(1)(f)**: Supervisory authorities have the power to obtain access to any premises of the controller and the processor. Controllers must ensure that their DPA audit rights are sufficient to support potential supervisory authority inquiries.

### EDPB Guidelines 07/2020 on Controller and Processor Concepts

- **Paragraph 110**: "The audit rights provided for in Article 28(3)(h) must be practical and exercisable. The controller should be able to conduct audits, either itself or by mandating a third-party auditor. The processor may not condition audit rights on requirements that would effectively prevent the controller from exercising them."

- **Paragraph 111**: "Third-party certifications (such as ISO 27001 or SOC 2 Type II reports) may supplement but not replace the controller's audit rights. The controller must always retain the right to conduct its own audit when warranted by circumstances."

- **Paragraph 112**: "Pooled audits, where multiple controllers jointly audit a shared processor, are an acceptable and practical mechanism, particularly for major cloud service providers."

### Bavarian DPA (BayLDA) — Processor Audit Guidelines (2022)

The BayLDA published detailed guidance on processor audit requirements:
- **Risk-based frequency**: Annual audits for high-risk processing, biennial for standard risk
- **Combination approach**: Questionnaire, documentation review, and on-site inspection should be combined based on risk level
- **Finding classification**: Recommend standardized severity classification (critical, major, minor, observation)
- **Remediation tracking**: Controllers must track finding remediation and verify completion
- **Documentation retention**: Audit records should be retained for a minimum of 3 years

### ISO 19011:2018 — Guidelines for Auditing Management Systems

While not legally binding, ISO 19011 provides the internationally recognized framework for audit methodology:
- **Clause 5**: Managing an audit programme
- **Clause 6**: Performing an audit (planning, conducting, reporting, follow-up)
- **Clause 7**: Competence and evaluation of auditors

## Supervisory Authority Enforcement

### CNIL Enforcement — Insufficient Processor Oversight (2023)

CNIL fined a controller for failure to exercise adequate oversight of a processor. The controller had not conducted any audits during a 4-year processing relationship despite the DPA granting audit rights. CNIL held that the mere existence of audit rights is insufficient — controllers must exercise them proportionate to risk.

### Danish DPA — Processor Audit Expectations (2021)

The Datatilsynet conducted a thematic inspection of municipalities' processor oversight. Key findings:
- Many controllers had never exercised their DPA audit rights
- Reliance solely on processor self-declarations was deemed insufficient
- Controllers must maintain documented evidence of processor oversight activities

### ICO (UK) — Processor Oversight Expectations

The ICO expects controllers to:
- Conduct or commission regular audits of processors
- Accept third-party certifications as partial evidence but not a complete substitute
- Maintain audit records demonstrating accountability
- Act on audit findings within reasonable timeframes