Introduction

This guide offers an operational template for creating an internal audit plan that addresses both personal data protection obligations (GDPR) and security requirements for networks and essential services (NIS2). The focus is practical: governance, audit cycles, detailed checklists and measurable metrics.

Context and objectives

  • Primary objective: assess the effectiveness of organizational and technical measures against legal requirements and identify actionable gaps.
  • Scope: personal data processing, critical services and networks, suppliers and third parties affecting resilience.
  • Expected outputs: audit report with evidence, prioritized remediation plan, compliance and security KPIs.

Governance: roles and responsibilities

Clear roles prevent overlaps and delays.

  • Data controller / Management: approves the annual plan, receives executive summaries and allocates resources.
  • Data Protection Officer (DPO) / Compliance: contributes to GDPR scoping and reviews findings.
  • Security lead / CISO: coordinates technical verifications and risk analysis.
  • Internal audit team or designated auditor: performs checks, drafts reports and recommends fixes.
  • Operational units: process owners, IT, procurement, legal, operations.

Audit cycle: planning, execution, reporting, follow‑up

  1. Planning
  • Define an annual plan with frequencies (e.g., critical processes semi‑annual, others annual).
  • Prioritize by risk, business impact and recent changes.
  • Produce a scoping document listing systems, processes, datasets and suppliers.
  1. Preparation and evidence collection
  • Request documentation: policies, processing records, DPIAs, contracts with security clauses, penetration test reports, asset inventory.
  • Gather technical evidence: network configurations, centralized logs, access control records, backups.
  1. Execution
  • Conduct interviews with process owners.
  • Perform technical checks (configurations, access controls, encryption) coordinated with IT to avoid disruption.
  • Verify day‑to‑day practices: incident handling, data subject request workflows, consent management.
  1. Reporting
  • Produce a technical report for operational management and an executive report for top management outlining residual risks and priorities.
  • Classify findings (critical, high, medium, low), include evidence, recommendations and owners for remediation.
  1. Follow‑up
  • Track remediation actions using KPIs and deadlines.
  • Validate completed actions and close tickets with documentary evidence.

GDPR checklist (practical items)

  • Governance and documentation

    • Updated record of processing activities.
    • DPIAs for high‑risk processing.
    • DPO appointment and documented involvement where required.

  • Lawfulness and data subject rights

    • Verify lawful basis for primary processing activities.
    • Procedures for exercising rights (access, rectification, erasure, portability).

  • Technical and organizational measures

    • Principle of least privilege and privileged access management.
    • Encryption of sensitive data at rest and in transit where applicable.
    • Documented and tested backups and recovery plans.

  • Incident response and notifications

    • Evidence of incident handling and processes to assess severity and impact.
    • Procedures to notify supervisory authorities and data subjects in accordance with legal timing.

  • Third parties

    • Contracts with data protection clauses and due diligence on subprocessors.

NIS2 checklist (network and service security)

  • Security governance

    • Up‑to‑date and approved security policies.
    • Roles for incident management and CSIRT contact points.

  • Risk management and technical controls

    • Inventory of critical assets and mapping of essential services.
    • Documented patch and vulnerability management procedures.
    • Network segmentation and access controls for critical infrastructure.

  • Monitoring and response

    • Logging systems and SIEM with appropriate retention and continuous monitoring.
    • Regular detection tests and incident response drills.

  • Supply chain and providers

    • Supplier risk assessments, security requirements in contracts and verification of compliance.

Key metrics and KPIs

  • Percentage of controls compliant vs. non‑compliant (coverage).
  • Number of open critical findings and mean time to remediate (MTTR remediation).
  • Number and percentage of DPIAs completed and kept up to date.
  • Mean time to detect (MTTD) and mean time to contain (MTTC) incidents.
  • Percentage of suppliers with security clauses and attestations received.
  • Frequency of backup tests and restore success rate.

Tools, documentation and evidence

  • Centralized repository for policies, registers and reports (GRC tool or controlled document store).
  • Standardized templates: scoping, checklists, findings report, incident playbook.
  • Exportable technical evidence: configurations, logs, test outputs.
  • Audit calendar with ownership and remediation status tracking.

Sample annual timeline (model)

  • Q1: critical process audits (identity & access, supplier management).
  • Q2: GDPR audits (new/changed processing), disaster recovery tests.
  • Q3: NIS2 infrastructure audits (network, monitoring, patching).
  • Q4: full review, close findings and plan next year.

Best practices

  • Integrate compliance and security audits to reduce duplication and gain holistic insights.
  • Engage operational teams early to ease evidence gathering and acceptance of remediation.
  • Always document evidence: a finding without proof is not actionable.
  • Go beyond checklists: the quality of interviews and technical tests matters most.

Conclusion

A robust internal audit plan turns regulatory verification into a repeatable risk reduction process. Use the governance model, checklists and KPIs above to measure progress and prioritize remediation. For specific legal deadlines and interpretation, consult qualified legal counsel.