What evidence do auditors commonly ask for on Art.35 Data protection impact assessment?

The screening or threshold process applied to new and changed processing, with its outcomes recorded including the negative ones; Completed assessments checked against the four minimum content elements Article 35(7) requires; The data protection officer's advice sought and given on each assessment, recorded as advice rather than as approval; Where the views of data subjects were sought, the record of what was asked and what came back, or the reasoning for not seeking them; Review records showing assessments were revisited when the processing or its risk changed, with the date and the trigger.

What is the most common gap auditors find on Art.35?

An assessment opened at project start and never revisited, so its residual risk conclusion is never tested against how the processing actually turned out

GDPR · Chapter IV - Controller and Processor

`Art.35` Data protection impact assessment

Where a type of processing, in particular using new technologies and taking account of the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data before the processing begins; a single assessment may address a set of similar operations presenting similar risks. An assessment is required in particular for systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions producing legal or similarly significant effects are based, for large scale processing of special category or criminal offence data, and for systematic monitoring of a publicly accessible area on a large scale. Seek the advice of the data protection officer where one is designated, and where appropriate seek the views of data subjects or their representatives. The assessment must contain at least a systematic description of the envisaged operations and purposes including any legitimate interest pursued, an assessment of the necessity and proportionality of the operations in relation to the purposes, an assessment of the risks to the rights and freedoms of data subjects, and the measures envisaged to address those risks including safeguards, security measures and mechanisms to protect personal data and demonstrate compliance. Carry out a review where necessary and at least when the risk represented by the processing operations changes.

Source: GDPR, Art.35. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.

Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.

artefacts

held by a system

at each review

hard

to go live

Document repository

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

Where the views of data subjects were sought, the record of what was asked and what came back, or the reasoning for not seeking them · Document repository
Review records showing assessments were revisited when the processing or its risk changed, with the date and the trigger · Document repository

governing documentDocuments that govern the control

The screening or threshold process applied to new and changed processing, with its outcomes recorded including the negative ones · HR system / LMS
Completed assessments checked against the four minimum content elements Article 35(7) requires · Document repository
The data protection officer's advice sought and given on each assessment, recorded as advice rather than as approval · Document repository

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

An assessment opened at project start and never revisited, so its residual risk conclusion is never tested against how the processing actually turned out
Necessity and proportionality asserted in a sentence, with all the substance of the assessment sitting in the security measures
Risk assessed to the organisation rather than to the rights and freedoms of the individuals the processing affects
Screening applied only to new projects, so material change to existing high risk processing never triggers an assessment
The data protection officer asked to approve the assessment rather than to advise on it, which compromises the independence Article 38(3) requires

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

Art.34 Communication of a personal data breach to the data subject · Art.36 Prior consultation