GDPR audit logging requirements (Article 32) and how to satisfy them

The control

Article 32 evidence usually gets requested alongside Article 30 records of processing and Article 33 breach-notification logs: the same tamper-evident event stream needs to support all three, not just prove security exists in the abstract.

What an auditor asks for

A data protection authority investigating a complaint, or your own DPO preparing an Article 30 record, wants proof that processing activity is actually logged and that the log itself hasn't been altered, not a policy document asserting that it is. They'll ask: who processed this data subject's record, on what legal basis, and can you show the entry is provably unchanged since it was written.

Retention requirement

AuditRails retains GDPR audit logs for a minimum of 5 years by default, long enough to cover typical supervisory-authority investigation windows and data-subject complaint periods. Retention extends automatically if you're also subscribed to a framework with a longer requirement.

What AuditRails captures

Consent and processing events map directly to a single logging call, with the legal basis captured as a required field rather than left implicit.

import { AuditRails } from '@auditrails/node';

const audit = new AuditRails({ apiKey: 'at_live_...' });

await audit.log({
  action: 'consent.given',
  actor_id: '...', // required
  metadata: {
    legal_basis: '...', // required
    purpose: '...', // required
    consent_version: '...', // optional
    ip_address: '...', // optional
    consent_method: '...', // optional
  }
});

What you hand your auditor

Generate an evidence bundle for your audit window and you get a zip containing a PDF summary report, the full event log as NDJSON, and a manifest with SHA-256 checksums of both files plus a hash-chain proof: something you can hand directly to a DPA or your DPO as supporting evidence, not a policy claim they have to take on faith.

Common ways teams fail this control

• Logging that consent was given, but not the legal basis or purpose it was given for. Article 32 evidence without Article 6 context doesn't answer the question an investigator actually asks.
• No record of consent withdrawal or objection events, only the original grant. Article 7(3)'s "as easy to withdraw as to give" expectation needs a symmetric log, not a one-sided one.
• Logs stored in the same system as the personal data they describe, editable by the same administrators, an auditor testing "integrity" finds nothing that actually proves it.
• Retention shorter than your actual data-subject complaint window, so evidence needed for a late-filed complaint or DPA inquiry simply isn't there anymore.
• No consistent actor_id linking a processing event back to a specific system or employee, making it impossible to demonstrate accountability under Article 5(2).

Frequently asked questions

This page describes regulatory obligations for information purposes and does not constitute legal advice. Whether they apply to your organisation should be confirmed with your own advisers.