While regular audits are not a legal requirement of the GDPR, one may be conducted by a DPA in the wake of a data breach or other regulatory violation. Companies that need to comply with GDPR should institute a program of regular internal audits to ensure they are meeting the requirements for compliance.