GDPR Q39
What is the accountability principle?
Q39. What is the accountability principle?
Category: Principles
The accountability principle makes compliance an ongoing responsibility—you must be able to show what you do and why.
In simple terms
- Implement policies, training, and governance.
- Keep records, DPIAs, and risk assessments up to date.
- Measure and report on compliance regularly.
Building an accountability framework
Set up governance structures, assign responsibilities, and document policies covering security, retention, and rights handling.
- Use a privacy management programme with clear ownership.
- Train staff regularly and keep attendance records.
- Monitor compliance with audits and KPIs.
Demonstrating accountability
Be prepared to show the ICO your documentation, including RoPAs, DPIAs, breach logs, and policies.
- Review documentation at least annually.
- Record decisions made by senior leadership on data protection matters.
- Engage with stakeholders, including data subjects, to gather feedback.
Practical steps to take
- Create an accountability roadmap with milestones.
- Assign data protection champions in each department.
- Track actions in a compliance register and review progress quarterly.
- Use metrics to report progress to the board.
- Update your programme when laws or business models change.
Real-life examples
Privacy steering committee
A company runs quarterly meetings reviewing DPIAs, incidents, and training statistics.
Compliance dashboard
An organisation tracks KPIs such as SAR response times, training completion, and breach metrics.
Helpful reminders
- Accountability applies to all controllers, regardless of size.
- Keep documentation accessible for audits and staff training.
- Review vendor compliance as part of your accountability framework.
Key takeaway
Make accountability visible—plan, document, measure, and continually improve.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.