Compliance Software Audit Trails: Mandatory Content 2026

1. Mandatory content per log entry

Timestamp in UTC, user ID, action (read / write / delete / export), affected record (hashed identifier rather than raw data), result (success / fail), source IP address. For privileged actions add session ID and approval reference.

2. GDPR-specific requirements

Log access to personal data. For special categories under Art. 9 GDPR (health, biometric, religion): add purpose annotation. Retention typically 3-10 years depending on the underlying processing activity. Logs themselves are personal data and need their own retention concept.

3. NIS2-specific requirements

Privileged-access logs, configuration changes, failed login attempts. Retention: 90 days operational plus 12 months archive (per BSI guidance under Section 30 BSIG, the German Cybersecurity Act). SIEM integration expected for organizations within scope.

4. Whistleblower Protection (HinSchG) requirements

Every action in reporting-channel software (read access, status change, comment) must be logged. Logs must be immutable. Retain 3 years after case closure under Section 11 HinSchG. Confidentiality protections apply: only the case owner may see who accessed which case.

5. Tooling options

Microsoft Sentinel (included in M365 E5), ELK stack (open-source, self-hosted), Splunk (enterprise), Datadog (mid-market). For SMEs: Sentinel is usually the path of least resistance if M365 is already in place.

6. Evidentiary value in court

Immutable logs (append-only with cryptographic chaining) carry stronger evidentiary weight than mutable logs. Hash chains plus qualified time-stamping provide the highest level of integrity evidence. For HinSchG and DPIA-relevant processing, immutability is the practical baseline.

Summary

Audit Trails are the backbone of defensible compliance. Each domain (GDPR, NIS2, HinSchG) layers its own requirements on top of a common baseline (timestamp, user, action, record, result, IP). Use a SIEM or equivalent log platform; for HinSchG and high-risk GDPR processing, prefer immutable storage.

View Compliance-Kit overview →