Role
A data auditor is the independent auditor a Significant Data Fiduciary must appoint to evaluate its compliance with the Act.
appoint an independent data auditor to carry out data audit, who shall evaluate the compliance of the Significant Data Fiduciary in accordance with the provisions of this Act.
The auditor is an external check. Section 10(2)(b) requires SDFs to appoint an independent data auditor to assess whether the organisation actually meets the Act's requirements.
This sits alongside the periodic Data Protection Impact Assessment and audit obligations, giving the Board and the fiduciary an evidenced view of compliance.
A notified SDF engages an independent auditor each year to review its consent flows, security and breach handling against the Act.
Who needs a data auditor?
Only Significant Data Fiduciaries, under Section 10(2)(b).
Must the auditor be independent?
Yes. The Act requires an independent data auditor.