What evidence do auditors commonly ask for on Art.39 Tasks of the data protection officer?

The officer's monitoring plan and its output, such as a review or audit programme with findings and their closure; Advice given, recorded with its date and outcome including where it was not followed and by whose decision; Training and awareness activity delivered or overseen, with coverage figures for the staff involved in processing operations; The officer's record of contacts as supervisory authority contact point, and of impact assessment advice given under Article 35(2); Evidence the monitoring effort is weighted by processing risk rather than spread evenly across the organisation.

What is the most common gap auditors find on Art.39?

The officer acting as the compliance delivery function, writing and running the very controls they are meant to independently monitor

GDPR · Chapter IV - Controller and Processor

`Art.39` Tasks of the data protection officer

The data protection officer must at least inform and advise the controller or processor and the employees who carry out processing of their obligations under the Regulation and other Union or Member State data protection provisions; monitor compliance with those provisions and with the controller's or processor's own data protection policies, including the assignment of responsibilities, awareness raising, the training of staff involved in processing operations, and the related audits; provide advice where requested on the data protection impact assessment and monitor its performance under Article 35; cooperate with the supervisory authority; and act as the contact point for the supervisory authority on processing issues including the Article 36 prior consultation, consulting on any other matter where appropriate. In performing these tasks the officer must have due regard to the risk associated with the processing operations, taking account of their nature, scope, context and purposes.

Source: GDPR, Art.39. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.

Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.

artefacts

held by a system

at each review

hard

to go live

Policy repository / GRC workspace

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

The officer's record of contacts as supervisory authority contact point, and of impact assessment advice given under Article 35(2) · Regulator portal / correspondence
Evidence the monitoring effort is weighted by processing risk rather than spread evenly across the organisation · SIEM / log platform

governing documentDocuments that govern the control

The officer's monitoring plan and its output, such as a review or audit programme with findings and their closure · Policy repository / GRC workspace
Advice given, recorded with its date and outcome including where it was not followed and by whose decision · Document repository
Training and awareness activity delivered or overseen, with coverage figures for the staff involved in processing operations · HR system / LMS

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

The officer acting as the compliance delivery function, writing and running the very controls they are meant to independently monitor
Advice given verbally and never recorded, so there is no evidence of what was recommended when a decision is later questioned
Monitoring reduced to a policy review cycle, with no testing of whether the processing actually follows the policy
No record kept of advice that was overridden, which is the evidence that most protects both the officer and the organisation

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

Art.38 Position of the data protection officer · Art.44 General principle for transfers