the Authority for Personal Data is coming to inspect what must I be able to show

The processing record is central to an inspection

During an inspection by the Dutch Data Protection Authority, the starting point is usually one document: the processing record. It shows which personal data are processed, for what purpose, who has access to it, how long it is kept and whether it is shared with others. This record is not optional — Article 30 of the GDPR describes what must be included and who is obliged to maintain it. In addition to the record, a supervisory authority typically also asks about the processor agreements with suppliers who process data on behalf of the company, and about how the security of that data is arranged.

What an inspection yields further depends on where the company's focus lies. For example, questions can be asked about the privacy notice that goes to customers or website visitors, about evidence that a data breach was assessed in time at the time, or about the assessment made in a high-risk processing. For anyone who needs to determine what should actually be in the record, what must be in a processing record? provides an overview of the elements. And because an inspection also extends to the agreements with SaaS suppliers or other parties that process data, the answer to what must be in a processor agreement? is relevant to what must be demonstrable.

Where this follows from: Article 30 and Article 32 GDPR

The obligation to maintain a record is set out in Article 30 of the GDPR, and in practice that record is the first document that appears during an inspection. Article 32 of the GDPR describes the obligation to implement appropriate technical and organisational measures to protect data, and a supervisory authority can ask how those measures are implemented. These two articles apply directly throughout the European Union, so the core of what must be demonstrable is the same everywhere. Who carries out the inspection and where it is requested or handled differs by country: in the Netherlands it is the Dutch Data Protection Authority, in other Member States a different national supervisory authority with its own procedures. More about the role of the Dutch supervisory authority can be found on the website of the Dutch Data Protection Authority.