What evidence do auditors commonly ask for on Art.38 Position of the data protection officer?

Evidence of timely involvement, such as standing membership of change, project and incident forums with attendance records; The reporting line as documented and as actually practised, including direct access to the highest management level and records of that access being used; The resource position: budget, staff, training days and system access rights granted to the officer; The conflict of interests assessment for any other duties the officer holds, refreshed when those duties change; Terms of engagement evidencing protection from dismissal or penalty for performing the tasks.

What is the most common gap auditors find on Art.38?

The officer consulted after decisions are taken, at approval rather than at design, which is not timely involvement

GDPR · Chapter IV - Controller and Processor

`Art.38` Position of the data protection officer

Ensure the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data. Support the officer in performing the Article 39 tasks by providing the resources necessary to carry them out, access to personal data and processing operations, and the means to maintain expert knowledge. Give the officer no instructions regarding the exercise of those tasks, do not dismiss or penalise the officer for performing them, and have the officer report directly to the highest management level. Data subjects may contact the officer on all issues related to the processing of their personal data and the exercise of their rights. The officer is bound by secrecy or confidentiality concerning the performance of the tasks. The officer may fulfil other tasks and duties, and the controller or processor must ensure those do not result in a conflict of interests.

Source: GDPR, Art.38. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.

Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.

artefacts

held by a system

at each review

hard

to go live

Document repository

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Evidence of timely involvement, such as standing membership of change, project and incident forums with attendance records · HR system / LMS

periodic reviewEvidence produced at each review

The conflict of interests assessment for any other duties the officer holds, refreshed when those duties change · Document repository

governing documentDocuments that govern the control

The reporting line as documented and as actually practised, including direct access to the highest management level and records of that access being used · Document repository
The resource position: budget, staff, training days and system access rights granted to the officer · HR system / LMS
Terms of engagement evidencing protection from dismissal or penalty for performing the tasks · Document repository

First move

Mostly documents and reviews. Pull the 1 system-held artefact from your HR system / LMS on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.

Common gaps auditors find

The officer consulted after decisions are taken, at approval rather than at design, which is not timely involvement
A reporting line to the highest management level that exists on paper and has never been used, with all real reporting through a manager whose work the officer must assess
The role held alongside responsibility for the systems and processing being assessed, which the Article treats as a conflict of interests
No budget or training allocation, so maintaining expert knowledge depends on the officer's own time

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

Art.37 Designation of the data protection officer · Art.39 Tasks of the data protection officer