Audit Preparation Supervisory Authority: 10-Point Checklist

Main article: GDPR fine proceedings: how they unfold — from receipt of the complaint to payment.

Audit preparation consists of two parts: the documents a supervisory authority can request without notice, and the organisation with which you answer the request. The following ten points keep the two apart. Statutory duties are given with a reference for Germany and — where the law differs — for Austria; statements without a reference are practical experience or assessments carried over from the first version and do not in themselves establish a legal obligation.

1. Documentation ready to hand

What belongs within reach are the documents a supervisory authority can request without notice: the record of processing activities, data processing agreements, data protection impact assessments, technical and organisational measures, the training log, the personal data breach log, the incident response plan (IRP) and audit reports — digital and on paper.

Behind these stand individual provisions, and they determine how complete the file has to be. For every Data Processor a contract is required containing the minimum content of Art. 28(3) GDPR (subject matter, duration, nature and purpose of the processing, types of data, categories of data subjects, obligations and rights of the controller); work may only be carried out with Data Processors that provide sufficient guarantees for appropriate technical and organisational measures (Art. 28(1) GDPR). The register of data protection impact assessments shows where a prior assessment under Art. 35(1) GDPR was required — in particular for a systematic and extensive evaluation of personal aspects producing legal effects, extensive processing of special categories of data and systematic extensive monitoring of publicly accessible areas (Art. 35(3) GDPR).

If a data protection officer has been appointed, the appointment belongs in the file. In Germany, the threshold of § 38(1) of the German Federal Data Protection Act (BDSG) applies in addition to the appointment duty under Art. 37(1) GDPR: at least 20 persons who are constantly engaged in automated processing as a rule — and, irrespective of the number of persons, also where processing operations are subject to a data protection impact assessment under Art. 35 GDPR. Austria does not provide for a numerical appointment threshold going beyond Art. 37 GDPR; there the appointment duty follows directly from Art. 37 GDPR (supplemented by § 5 of the Austrian Data Protection Act (DSG) on the secrecy obligation and independence of the data protection officer). For entities subject to NIS2 there is an additional requirement in Germany: compliance with the risk management measures must be documented (§ 30(1) BSIG); in Austria the evidence requirement follows § 33 NISG 2026 (see point 9).

Practice rhythm, not a statutory deadline: update the record of processing activities annually and whenever changes occur (Art. 30 GDPR), review the technical and organisational measures annually and after incidents (Art. 32 GDPR).

2. Compliance officer as single point of contact

One named person coordinates all audit requests — this prevents contradictions between departments answering the same question differently.

Part of these contact details is in any case on file with the authorities for entities subject to NIS2. Particularly important and important entities as well as domain name registry service providers must register no later than three months after they first qualify as such, using the registration facility set up jointly by the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK), and must submit their name, address and contact details, the relevant sector under Annex 1 or 2, the EU Member States concerned and the competent supervisory authorities (§ 33(1) BSIG); changes must in principle be notified without undue delay, at the latest within two weeks (§ 33(5) BSIG). In Austria the same registration runs through the Cybersecurity Authority, likewise within three months of entry into force or of the conditions being met, and with a two-week deadline for changes to the core data (§ 29(2) to (4) NISG 2026) — the NISG 2026 applies from 1 October 2026. Anyone who names a different internal point of contact from the one submitted on registration produces exactly the contradictions this point is meant to avoid.

Practice recommendation: a deputy arrangement, agreed wording in writing and an escalation plan (who informs the management, who brings in legal counsel). The agreed wording sets down in writing who answers which topics, what formulation applies where something cannot be substantiated ('We will follow up in writing') and that figures are only quoted from approved documents. For answering a supervisory questionnaire, the first version of this article gives 14 to 30 days as the typical range — an experience value, not a statutory deadline; what governs is the deadline set in the specific letter.

3. Legal counsel

At an on-site audit, legal counsel should be present, because procedural rights have to be exercised during the meeting itself. In practice this means not conclusively accepting the scope of a request for information during the meeting, handing over documents only against a receipt, and recording statements rather than giving them spontaneously — that is practical experience, not a legal obligation.

What is at stake follows from the level of sanction that can stand at the end of the proceedings. Infringements of certain obligations — among others Art. 25 to 39 GDPR — are subject to fines of up to EUR 10,000,000 or 2% of worldwide annual turnover (Art. 83(4) GDPR), infringements of processing principles, conditions for consent or data subject rights up to EUR 20,000,000 or 4% (Art. 83(5) GDPR) — whichever amount is higher. In addition, § 43(2) and (3) BDSG applies in Germany (fine of up to EUR 50,000 for certain administrative offences), and in Austria § 62(1) DSG (administrative penalty of up to EUR 50,000 for certain intentional infringements, with the Data Protection Authority competent). In the NIS2 area, the BSI bases its supervisory and enforcement measures on §§ 61, 62 BSIG; in Austria the competent authority is the Cybersecurity Authority (§ 3a(1) and (2) NISG 2026). The range of fines for infringements of the risk management and reporting obligations extends in Germany to EUR 10 million (particularly important entities) or EUR 7 million (important entities) (§ 65(5) no. 1 BSIG); in Austria to EUR 10,000,000 or 2% for essential entities and to EUR 7,000,000 or 1.4% of worldwide annual turnover for important entities (§ 45(2) and (3) NISG 2026). Austria adds a further measure: the Cybersecurity Authority may temporarily prohibit the management bodies of an essential entity from exercising management functions by administrative decision (§ 39(4) no. 2 NISG 2026, with entry in the commercial register).

4. Preparing employees

Training on 'What do I say in an audit?': the truth, but no self-incrimination. Where there is uncertainty: 'I do not know, the compliance officer can answer that'. This answer is not a refusal but the alternative to speculation.

In one respect confidentiality is not a matter of style but a duty: reporting channels must preserve the confidentiality of the identity of the reporting person, of the persons concerned and of the other persons named in a report; the identity may only be disclosed to the persons responsible for receiving reports and taking follow-up measures and to those supporting them (§ 8(1) of the German Whistleblower Protection Act (HinSchG)). In Austria the corresponding rule follows from § 7(1) and (2) of the Austrian Whistleblower Protection Act (HSchG) — there, persons who learn the content of a report without authorisation are expressly prohibited from passing on the content and the identity. Anyone speaking about a reporting procedure in an audit therefore speaks about procedures and deadlines, not about persons.

The training records are themselves subject to review — which training duties apply to management and employees in Germany and Austria, and at what intervals records are kept, is set out in the FAQ.

5. Preparing the premises

Two categories of documents are kept physically separate — as a matter of practice for special categories of personal data, and as a consequence of an express confidentiality duty for documents from the internal whistleblowing system. Neither belongs openly in the audit file; both are made available only on a specific request and through the responsible body. A conference room with a projector or screen, WiFi for the auditor and coffee or water are by contrast purely practice recommendations.

For the first category, separate filing is a matter of practice: Art. 9(1) GDPR names the catalogue — health data, data on ethnic origin, political, religious or philosophical beliefs, trade union membership, genetic data and biometric data for unique identification, data concerning sex life — not how they are handled during the inspection. For the second category, by contrast, an express confidentiality duty stands behind it; the references for Germany and Austria are set out in point 4.

Practice recommendation: a separate, non-visible storage place for documents not needed during the meeting — and a printer within reach, because, in practice, some authorities require paper copies.

6. Management present?

Usually not required, but useful for critical topics — that applies as practical experience to continuous presence during the meeting.

On NIS2 topics, however, the management is itself an addressee of duties, not merely the recipient of a report. The management bodies of particularly important and important entities are obliged to implement the risk management measures under Section 30 BSIG and to monitor their implementation (§ 38(1) BSIG); if they breach this duty, they are liable to their entity for the damage culpably caused, under the rules of the company law applicable to the legal form (§ 38(2) BSIG). In Austria the management bodies of essential and important entities must ensure and supervise compliance with the risk management measures under § 32 NISG 2026 (§ 31(1) NISG 2026); the NISG 2026 contains no express internal liability provision comparable to § 38(2) BSIG — liability there follows general company law (§ 25 of the Austrian Limited Liability Companies Act (GmbHG) for Austrian companies, in Germany § 43(1) and (2) GmbHG).

Practice recommendation: instead of permanent attendance, plan a fixed time slot for governance topics and book the management in for it bindingly.

7. Communication style

Factual, cooperative, precise. Neither defensive nor aggressive. The degree of cooperation with the supervisory authority in order to remedy the infringement and mitigate its possible adverse effects is one of the criteria to which due regard is to be given when deciding on a fine and its amount (Art. 83(2)(f) GDPR); the other criteria are set out in the FAQ — no fixed reduction rate follows from this.

Within the scope of the AI Act, precision is expressly subject to sanction: supplying incorrect, incomplete or misleading information to authorities is subject there to fines of up to EUR 7,500,000 or 1% of total worldwide annual turnover, whichever is higher (Art. 99(5) AI Act). For SMEs, including start-ups, the lower of the two amounts applies in each case (Art. 99(6) AI Act).

The NIS2 reporting regime has a similar graduation: if a reported security incident is still ongoing, a progress report must first be submitted and the final report only after the matter has been fully dealt with (§ 32(1) and (2) BSIG; Austria: § 34(2) no. 5 NISG 2026). Anyone who distinguishes in the meeting between a confirmed statement and a provisional assessment stays consistent with this graduation.

Practice recommendation: record questions that cannot be answered with substantiation during the meeting and follow up in writing, rather than estimating them orally.

8. Accompanying employees during the audit

Whether the compliance officer may be present at an employee interview should be clarified with the authority in advance (practice recommendation, no reference). How this accompaniment works in practice is set out in the FAQ.

Express protective provisions apply in two constellations — equal treatment matters and whistleblower reports. In Germany the employer may not disadvantage employees because they exercise rights under the protection against discrimination, refuse an instruction that infringes that part of the Act, or give evidence as witnesses (§ 16(1) of the German General Equal Treatment Act (AGG)); in Austria the prohibition of disadvantage as a reaction to complaints or proceedings applies under § 13 and § 27 of the Austrian Equal Treatment Act (GlBG), expressly including witnesses and persons providing information. For reports from the whistleblowing system there is more: reprisals are prohibited, including their threat and attempt (§ 36(1) HinSchG); if a reporting person claims to have suffered a disadvantage in connection with their professional activity as a result of their report, it is presumed that the disadvantage is a reprisal — the person causing the disadvantage must then prove that it was based on sufficiently justified grounds or was not based on the report (§ 36(2) HinSchG). In Austria retaliatory measures are legally ineffective (§ 20(1) HSchG); there a lower standard of prima facie evidence applies (§ 23 HSchG) instead of the German reversal of the burden of proof.

9. Documenting the audit

Keep your own minutes: for each meeting, record the date and time, the names and function of all those present including the authority's representatives, every question verbatim, every document handed over with its version and page count against an acknowledgement of receipt, and every promised follow-up with a target date.

To be distinguished from this are the periodic evidence obligations that run independently of the meeting — and they differ considerably between Germany and Austria. In Germany the periodic evidence obligation primarily affects operators of critical installations: they must demonstrate implementation of the measures under § 30(1) in conjunction with § 31 BSIG at a point in time set by the BSI — at the earliest three years after they first qualify as the operator of a critical installation — and thereafter every three years by means of security audits, examinations or certifications, and must transmit the results including any security deficiencies identified (§ 39(1) BSIG). In Austria the evidence obligation affects all essential and important entities: a self-declaration of the risk management measures implemented within twelve months of the registration obligation arising, and on request evidence by an independent body within two years — essential entities must demonstrate operational and organisational implementation within as little as two months of being requested to do so (§ 33(1) and (2) NISG 2026).

For processing based on consent, the additional requirement of demonstrability under Art. 7(1) GDPR applies — record in the minutes which consent records were handed over.

10. Follow-up

Within 14 days: lessons learned (every question that could not be answered with substantiation during the meeting, together with the missing document and a responsible person), an action plan and, where appropriate, a proactive communication to the supervisory authority. The 14 days are a practice rhythm, not a statutory deadline.

Statutory deadlines run independently of this — and they begin with their respective statutory trigger, for a personal data breach with awareness of it, not with the end of the audit. Where a Personal Data Breach becomes apparent, it must be notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours after having become aware of it — unless it is unlikely to result in a risk to the rights and freedoms of natural persons; where the notification is made later, reasons for the delay must be given (Art. 33(1) GDPR). Where the breach is likely to result in a high risk to the rights and freedoms of natural persons, the data subject must additionally be informed without undue delay — unless one of the exceptions in Art. 34(3) GDPR applies (in particular encryption, subsequent elimination of the risk, or disproportionate effort combined with a public communication). If the follow-up shows that the registration data is no longer correct, the two-week notification from point 2 applies.

Practice recommendation: give the action plan responsible persons and target dates and call it up in the next management review — it is the first question at the follow-up meeting.

Who audits: supervisory authorities in Germany and Austria

Which authority gets in touch depends on the area of law and the country of establishment — the same duty is supervised in Germany and Austria by different bodies and on a different legal basis. The following overview names the competent bodies for each area of law — for the AI Act, for Germany the authorities designated since 29 July 2026 by the KI-MIG and, for Austria, the state of the designation under Art. 70 AI Act still missing as at 17 August 2026 — and, for whistleblower protection, the sanction range.

Deadlines that apply in the audit context

An audit does not suspend any deadline. All rows of the following table are statutory deadlines with a reference; practice rhythms are not included. To place the timing: registration must be carried out under § 33(1) BSIG no later than three months after the entity status arises; the BSI points out that the statutory registration deadline has already expired. There is no official date for the start of supervisory and fining practice. In Austria the NISG 2026 starts to apply on 1 October 2026.