This book deals with the tension between law and technology of data protection topic, to propose a novel approach for interpreting personal data protection audit. Audits have long been criticized as “a ritual of verification,” originating from the financial sector. While this book proposed that audit is in fact a regulatory control system rather than a verification tool, especially dealing with audit of data. The prerequisite for reading this book is a basic understanding of data protection, audit system, information technology as well as administrative law.