Accountability

Accountability is one of the seven core principles of the GDPR and is enshrined in Art. 5(2) GDPR. It means that the controller is not only responsible for complying with the other principles of Art. 5(1) — lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality — but must also be able to actively demonstrate that compliance. The burden of proof lies with the controller, not the supervisory authority.

In concrete terms, organisations must design and document their data protection processes in such a way that, in the event of a supervisory authority inspection or a complaint from a data subject, they can provide complete evidence of GDPR compliance. The key instruments of accountability include the Record of Processing Activities (Art. 30 GDPR), documented Data Protection Impact Assessments (Art. 35 GDPR), written Data Processing Agreements (Art. 28 GDPR), records of consent, and evidence of staff training.

For compliance officers, accountability is the overarching guiding principle for all data protection work: it is not enough to act in a GDPR-compliant manner — that conduct must also be provable. A well-maintained data protection management system that comprehensively documents all measures, decisions, and reviews is therefore not only a legal requirement but also an effective tool for risk minimisation and for demonstrating trustworthiness to customers and business partners.