An GDPR audit should focus on legal and organisational issues as well as on the IT-related area. In this article, we focus on the organisational and legal audit. But let’s start at the beginning.