Regulator-ordered professional audit
Authorities may require an independent professional institution where processing presents serious impact/lack of safeguards, may infringe many individuals' rights, or an incident affects at least 1 million persons' PI or 100,000 persons' sensitive PI.