Article 33 (audits)

• 1

  The controller shall cause the implementation of the rules given by or under this Act to be monitored by means of periodic privacy audits.

• 2

  The controller shall send a copy of the audit results of the privacy audits to the Autoriteit persoonsgegevens.

• 3

  If the inspection results show that the provisions under or pursuant to this Act are not complied with, the controller shall, within one year, have a re-inspection carried out on those parts that did not comply with the specified conditions. The second paragraph shall apply mutatis mutandis.

• 4

  Any person involved in an inspection as referred to in the first or third paragraph shall be obliged to maintain the confidentiality of the personal data to which he has been given access, except insofar as any statutory provision obliges him to disclose or his duty requires him to do so.

• 5

  By or pursuant to an order in council, further rules will be laid down regarding the content and manner of carrying out the inspections referred to in the first and third paragraphs.