Audit logging: keeping a defensible record

Why this is worth its own discussion, not just a mention elsewhere

Audit logging comes up throughout this knowledge base as a supporting detail — a legal hold is logged, a retaliation flag's resolution is logged, an erasure is logged. What doesn't get said directly anywhere else is why that logging is the thing that actually matters, not the action it's attached to. GDPR's accountability principle (Art. 5(2)) doesn't just require a company to comply with data-protection law — it requires being able to demonstrate compliance, and Art. 24 translates that into a concrete obligation to implement measures that make demonstrating it possible. A record of what happened, kept honestly, is how "we handled this properly" stops being an assertion and becomes something you can actually show.

What a defensible record actually needs to capture

The useful test for any audit log, whatever platform produces it: could someone outside the company — a regulator, a court, an employee who feels they were treated unfairly — reconstruct what happened and when from it, without having to take anyone's word for it? That generally means capturing, for every action that matters:

• Who did it. Not "a handler," a specific, attributable person or account.
• When. A real timestamp, not an approximate recollection reconstructed later.
• What changed. The actual before-and-after, not just that something happened.
• Why, for anything that involved a judgment call. A status change or a routine update might not need a reason attached — but a legal hold, an erasure, or a retaliation-incident resolution should, because those are exactly the actions someone might later ask "why did you do that" about. See when to place a legal hold and handling a retaliation flag for two concrete examples of decisions that need a reason on the record, not just a timestamp.

The gap most logs have: who looked, not just who changed

A log that only captures changes — status moves, notes added, an outcome recorded — misses half of what confidentiality actually requires. Art. 9(1)(a)'s channel-security obligation is about preventing access by non-authorised staff, which means who viewed a case is just as much a confidentiality-relevant fact as who edited it. If a company can show who changed a case but not who looked at it, it can't actually answer the question a confidentiality breach investigation would ask first: who had eyes on this. A defensible record covers access, not only edits.

The record is what discharges the burden, not just supports it

This matters most concretely in exactly the situation covered in what counts as retaliation: once a reporter shows they made a report and then suffered a detriment, Art. 21(5) presumes that detriment was retaliatory, and it's the company's burden to prove otherwise. At that point, a documented, timestamped record of why a decision was made isn't a nice-to-have that supports the company's case — it's the only thing that can discharge that burden. A company relying on memory, or on informal Slack messages nobody thought to keep, is trying to prove a negative after the fact with nothing built for the purpose.

How Provoxis has implemented this

Provoxis writes every one of these actions — setting or releasing a legal hold, flagging or resolving a retaliation incident, erasing a report — as an audit-log entry created in the same database transaction as the action itself. That's a structural guarantee, not a process one: the system is built so the action can never succeed without a corresponding logged record of who did it, when, and why, rather than logging being a separate step that could fail, get skipped, or be added after the fact. A company running its own process on top of a shared inbox or a spreadsheet is relying on someone remembering to make the note — a defensible record shouldn't depend on that.

Legal basis

• Art. 5(2), GDPR — the accountability principle: the controller must be able to demonstrate compliance, not just comply.
• Art. 24, GDPR — the obligation to implement measures that make demonstrating compliance possible.
• Art. 21(5), Directive (EU) 2019/1937 — the burden-of-proof reversal a documented record is what actually discharges.