As someone who is going through a data protection audit with his company: They take the process very seriously and ask some tough questions. It's better to be prepared and play it right from day 1. Proper documentation matters as well.