The protection of personal data is an obligation imposed on all entrepreneurs. Many of them have not yet implemented the GDPR in their organization. Some implemented them a few years ago, but since then they have not done any audit of the correct operation of their protection system. Our experience shows that the subject of personal data protection is still valid, evolving and requires constant attention.