A GDPR auditor asks you to prove what you do, not just say it. Expect requests for records of processing, security measures, breach documentation, processor contracts, data subject request logs and lawful basis decisions. Keep each in a findable place with an owner and a review date.
Why is evidence the center of it?
GDPR builds on accountability. The EDPB links breach documentation to the accountability principle in Article 5(2), and the logic extends: if you cannot show a decision was made and why, you may be treated as if it was not (EDPB).
This post lists evidence categories. It is not legal advice, and the Article 30 and Article 5(2) text was not retrievable in our search, so check those against EUR-Lex.
The evidence list
Records of processing. A register of what personal data you process, why, where it goes and how long you keep it. The auditor will test whether it matches reality by asking a team what they do.
Lawful basis decisions. For each purpose, which basis you rely on and why. For consent, how you record and withdraw it.
Security measures. Article 32 requires technical and organisational measures that fit the risk. The EDPB's case digest notes authorities have found breaches of it where websites collected bank account data over plain HTTP and where passwords were stored in plain text (EDPB case digest). Show your encryption, access control, testing and patching evidence.
Breach documentation. Article 33 requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk individuals. Late notices need reasons. Article 33(5) requires every breach to be documented, including those you did not notify (Article 33). Keep the log, the assessment and the decision.
Processor contracts. Written terms with each vendor that handles personal data, and a way to show you vetted them.
Data subject requests. A log of access, deletion and other requests, with dates received and answered.
Impact assessments. Where processing is high risk, the assessment you carried out and its outcome.
Training and policies. Staff training records, and the privacy and security policies with approval dates.
Retention and deletion. The schedule, and proof that deletion actually runs.
Transfers. For data sent outside the EEA, the mechanism you rely on.
What goes wrong in practice?
The register is out of date. A breach log exists only for incidents that were notified. A processor list omits tools adopted by one team. Requests were handled by email with no tracking. Those are process gaps, not technology gaps, and they are the usual reasons an evidence request stalls.
How should you store it?
Keep one evidence folder per category, with a short index that says what each file proves, who owns it and when it was last reviewed. Use dated exports instead of screenshots where you can. When an auditor asks for something, you should be able to answer within a day, not a week.
What to do
- Assign an owner to each category above.
- Check the processing register against what two teams actually do.
- Log every incident, including near misses and non-notified breaches.
- List every processor and confirm a contract is in place.
- Track data subject requests in a system with timestamps.
- Keep security evidence as dated exports, not screenshots.
- Review the pack quarterly and note the review date.
Quick check
Do we have to notify every breach within 72 hours?
No. Notification is required unless the breach is unlikely to result in risk to individuals. But you must still document every breach, and you must be able to justify the decision.
Does a tool make us GDPR compliant?
No. Tools help produce and store evidence. Compliance depends on your processes and decisions.
Sources
- GDPR Article 33
- EDPB Guidelines 9/2022 on breach notification
- EDPB case digest on security and breach notification
Last reviewed: 18 October 2026.
