According to art. 96 of Royal Decree 1720/2007 of 21 December , which approves the Regulations for the development of Organic Law 15/1999, of 13 December, on the protection of personal data, hereinafter "Regulation Of the average security level, the information systems and data processing and storage facilities shall be subject to an internal or external audit to verify compliance "of Title VIII of the Regulation, at least every two years , adding that" To carry out such an audit whenever there are substantial changes in the information system that may have an impact on compliance with the security measures implemented in order to verify the adaptation, adequacy and effectiveness of the same . This audit starts the calculation of two years indicated in the previous paragraph. It is said later that the audit report should be available to data protection agencies but does not indicate how long these reports should be kept. The art. 44.3 h) of Organic Law 15/1999,...