Data Protection Audit: Framework and Checklist

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

A data protection audit has become essential for companies that handle personal information. It works as a complete diagnosis of LGPD (Brazil’s General Data Protection Law) compliance and a shield against administrative sanctions.

What a data protection audit is and why it matters

A data protection audit is a structured process for evaluating the practices, policies, and controls an organization uses to handle personal data. Unlike a simple document review, an audit involves technical verification, interviews with data processors, analysis of data flows, and security testing. It is a preventive tool that lets you identify vulnerabilities before they turn into security incidents or administrative proceedings before the ANPD (Brazil’s National Data Protection Authority).

A data protection audit is not a one-time event. It is a cyclical process that should be built into corporate governance to ensure ongoing compliance with the LGPD.

The General Data Protection Law (Law 13.709/2018) provides that controllers and processors must adopt technical and administrative security measures capable of protecting personal data. The audit is the mechanism that shows whether those measures actually exist or remain only on paper. Organizations that conduct periodic audits demonstrate accountability, one of the core principles of Brazilian data protection law.

Beyond legal compliance, an audit adds strategic value to the business. Business partners, investors, and customers increasingly demand evidence of privacy maturity. In due diligence for mergers, acquisitions, or investment rounds, audit reports can speed up negotiations and reduce perceived risk. Companies that neglect this practice often discover flaws only when they are already facing a data breach or a notice from the ANPD.

This topic is directly related to data protection in the financial sector, which is covered in a dedicated article.

This topic is directly related to privacy impact assessments, which are covered in a dedicated article.

A framework for conducting the audit: the five essential phases

In practice, an audit framework has been developed that is divided into five sequential phases, each with specific objectives and deliverables. This model can be adapted to organizations of different sizes and industries.

Phase 1: Planning and scope definition

In this initial stage, you define which areas, systems, and processes will be audited. You map the stakeholders involved, set a timeline, and allocate resources. Senior management should formalize its commitment to the audit in an internal document, which secures the cooperation of every department. You also check whether earlier audits exist and what they found, creating a baseline for comparison.

Phase 2: Data mapping and inventory

You carry out a complete survey of the personal data the organization handles. This means identifying which categories of data are collected, where they are stored, who has access to them, with whom they are shared, and what the legal basis is for each processing operation. You build the record of processing activities (ROPA) required by the LGPD and check whether it is up to date. In this phase, you interview the managers of each department and analyze contracts with third parties that access personal data.

Phase 3: Compliance assessment and gap analysis

With the inventory in hand, you compare the practices you identified against the requirements of the LGPD and, where applicable, against industry-specific rules and international standards such as ISO 27701. You check whether privacy policies, consent forms, procedures for honoring data subjects’ rights, incident response plans, and information security controls exist and actually work. Each item reviewed receives a risk rating (high, medium, or low) and a recommended fix.

Phase 4: Technical testing and verification

In addition to document analysis, you run hands-on checks. You test whether anonymization and pseudonymization mechanisms work correctly, whether access controls are implemented according to policy, whether backups are performed, and whether data is deleted when the data subject requests it or when the purpose of the processing ends. You simulate data subject requests to evaluate response times and the completeness of the information provided.

Phase 5: Report and action plan

You consolidate all findings in a structured report, with the evidence collected, risk ratings, and prioritized recommendations. The report should be presented to senior management and to the data protection officer (DPO). You then draw up an action plan with deadlines, responsible parties, and tracking indicators for each instance of noncompliance identified.

A practical checklist: the 25 items every audit should cover

To make the framework above easier to apply, here is a comprehensive checklist to use as a guide in audits. The items are grouped by category and can be adapted to the size and industry of the organization.

Governance and policies

Check whether the organization has a published, accessible privacy policy, whether a data protection officer (DPO) has been formally appointed, and whether the DPO’s contact information is available to the public. Assess whether there is an internal data protection policy approved by the board, whether there is a periodic training program for employees, and whether contracts with processors and subprocessors contain adequate data protection clauses. Also confirm whether there is a privacy committee or an equivalent governance structure.

Legal basis and consent

Analyze whether each processing operation has a clearly defined and documented legal basis. When the legal basis is consent, check that it is collected freely, with full information, unambiguously, and for a specific purpose. Confirm that there is a way to withdraw consent that is as easy as giving it. Assess whether legitimate interest, when used, is supported by a data protection impact assessment (known in Brazil as a RIPD) or equivalent documentation showing that the controller’s interests were balanced against the data subject’s rights.

Data subject rights

Test whether the organization has an accessible channel for receiving data subject requests. Check whether internal procedures make it possible to handle requests for access, correction, deletion, portability, and objection within the legal deadlines. Assess whether the response workflow is documented and whether the employees responsible have been trained to carry it out correctly.

Information security

Review logical and physical access controls over personal data, including multifactor authentication, encryption in transit and at rest, password policy, and privileged access management. Assess whether there is a security incident response plan that includes procedures for notifying the ANPD and affected data subjects within the deadlines set by law. Check that access logs exist and that they are monitored regularly.

Retention and deletion

Analyze whether the organization has a data retention policy with set periods for each category of data and each processing purpose. Check whether deletion procedures are carried out securely (logical or physical destruction that makes recovery impossible) and whether the deletions performed are recorded. Confirm that data kept to meet a legal or regulatory obligation is segregated and under restricted access.

Data due diligence in corporate transactions

In mergers, acquisitions, and investments, the data protection audit plays an even more critical role. Data due diligence aims to uncover hidden liabilities tied to inadequate personal data practices that could lead to fines, lawsuits, or reputational damage after the deal closes.

In these situations, the scope of the audit expands to include a review of the history of security incidents, a check of administrative or judicial proceedings related to data protection, an assessment of international data transfers, and the compatibility between the target company’s practices and those of the acquiring company. The due diligence report should sort the risks it finds into categories of financial impact, so the parties can negotiate indemnification clauses or adjustments to the price of the deal.

You should also assess the maturity of the target company’s privacy program as a whole. Organizations with a robust program, including up-to-date policies, regular training, an active DPO, and an audit history, pose less risk to the buyer. On the other hand, companies without structured data governance may require significant investment in compliance after the transaction, and that must be factored into the financial modeling of the deal.

Common mistakes and how to avoid them

Across experience with data protection audits, the same patterns of mistakes show up in organizations from very different sectors. The most common is treating the audit as a purely paper exercise, limited to confirming that policies exist without assessing whether they are actually implemented and followed day to day. Policies that exist only to “check the box” do not protect the organization in an inspection or an incident.

Another frequent mistake is running the audit without involving the operational areas. Often, the legal or compliance department conducts the process in isolation, without consulting the technology, human resources, marketing, and customer service teams, which are precisely the areas that handle personal data in the greatest volume. The audit needs to reflect operational reality, not just management’s idealized view.

We also see organizations that conduct a single audit and consider the work done. Data protection is a dynamic process: new systems are rolled out, new business partners are hired, the law evolves, and the ANPD publishes new guidance. We recommend a full audit at least once a year, with spot checks every six months on the items rated high risk in the previous audit.

Finally, it is worth stressing the importance of documenting every stage of the audit with objective evidence. In an inspection, the ANPD may ask for proof of the measures the organization has adopted. Well-structured audit reports, with photographs, screenshots, interview records, and test results, serve as proof that the organization acted with diligence and good faith in handling personal data.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.