The Principle of Accountability

The Principle of Accountability under the GDPR: A Comprehensive Guide

The GDPR privacy principles set out the core standards you should follow if you process personal data. There are six in total. However, at the end of the privacy principles comes a seventh item: the principle of accountability.

In the ever-evolving landscape of data protection, the principle of accountability has emerged as a fundamental cornerstone. The implementation of the General Data Protection Regulation (GDPR) has placed accountability at the forefront, reinforcing the need for organisations to take responsibility for how they collect, process, and manage personal data.

• What Does the GDPR Say?

• Understanding the GDPR Privacy Principles

• The Principle of Accountability Defined

• What Does This Look Like?

• The Accountability Principle in Practice

• Challenges in Implementing Accountability

• Conclusion: Embracing the Principle of Accountability

What Does the GDPR Say?

Article 5(2) of the GDPR reads “The controller shall be responsible for, and be able to demonstrate compliance with, [the six privacy principles] (‘accountability’)”.

Understanding the GDPR Privacy Principles

To understand accountability, we must first comprehend the essence of the GDPR. This monumental regulation, introduced in 2018, revolutionised data protection by setting stringent standards for the handling of personal information. The GDPR is underpinned by six core principles, and accountability is intertwined with each of them. These principles include lawfulness, fairness, and transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality.

Learn More About the Six Privacy Principles

Click on the title below to see a detailed explanation of each of the privacy principles:

1. Lawful, Fairness and Transparency

2. Purpose Limitation

3. Data Minimisation

4. Data Accuracy

5. Storage Limitation

6. Integrity and Confidentiality

The Principle of Accountability Defined

The principle of accountability applies to the data controller. The data controller is the person or organisation that decides what personal data is needed, and the purposes it is needed for.

The accountability principle requires them to have measures in place to demonstrate compliance with the GDPR and related data protection laws.

The principle requires data controllers to proactively demonstrate adherence to the privacy principles.

What Does This Look Like?

Accountability is enshrined in the GDPR. It’s intricately linked with the principles of lawfulness, fairness, and transparency. Organisations must have a legal basis for processing personal data and must ensure that their data processing activities adhere to these principles. At its core compliance looks like this:

• all data processing must have a clear lawful basis

• data should only be used for specific purposes and not for anything else

• only the minimum personal data necessary for those purposes is collected

• reasonable efforts must be taken to ensure personal data is accurate and up to date

• data should not be retained longer than necessary

• personal data must be kept safe and secure

The Accountability Principle in Practice

There are a number of things data controllers need to do to comply with the GDPR duties (and demonstrate that compliance). This first of those comes down to relationships.

Data Processors

The principle of accountability refers to data controllers, as they are ultimately responsible for GDPR compliance. However, there is also another actor in data processing – the data processor.

Data processors process personal data on the instruction of the data controller. Therefore data controllers are also accountable for data processors’ activity.

In any controller-processor relationship there must be some form of contract or data sharing agreement that sets out who is who, and how issues like data breaches or people’s rights will be handled.

Data Protection by Design and by Default

Accountability extends to embedding data protection by design and by default. Organisations should consider privacy from the outset, implement default privacy settings, and take proactive steps to minimise data processing.

Data protection by design and by default basically means putting planning for GDPR compliance at the core of your organisational strategy.

• learn more about data protection by design and by default here.

Data Privacy Impact Assessments (DPIAs)

Where processing is likely to result in high risks to individuals, data privacy impact assessments (DPIAs) are necessary. These assessments are a key element of accountability and help organisations identify and mitigate risks.

Completing and recording DPIAs is a good way of demonstrating accountability, as well as being a useful tool for making decisions on data processing activities.

Record of Processing Activities

The heart of accountability lies in maintaining detailed records of processing activities (ROPA). These records document what personal data is processed, for what purpose, and how long it is retained, among other things.

Keeping these records up-to-date is a crucial aspect of accountability. For this reason it is also a statutory requirement of the GDPR. Without a ROPA it would be easy to lose track of what data you have, what you are using it for, and who has access to it.

Managing Consent

Consent is another area where accountability is important. Consent is a tricky lawful basis to get right because:

• you must be able to show that people gave consent

• there are specific rules around consent when it comes to children

• people must be able to withdraw consent at any time

Data controllers must have the right systems in place to manage, and record, consent.

Data Breaches

In the unfortunate event of a data breach, organisations must demonstrate accountability by promptly notifying authorities and affected individuals. Cooperation and clear communication are vital during these times.

• find out more about handing a data breach here.

Cross-Border Data Transfers

The GDPR has a global reach, and accountability extends to international data transfers. Organisations must ensure that data protection is not compromised when data crosses borders. They can do this by:

• transferring data to countries that apply the GDPR

• transferring data to countries that have an “adequacy agreement” – countries that have adequate data protection legislation of their own

• transfer data internationally with the appropriate and robust contractual clauses

Data Protection Policies

Drafting robust data protection policies and providing employee training are essential for fostering a culture of data protection within an organisation. These elements are integral to accountability. As well as a general data protection policy additional policies may be needed if you process sensitive or “special category” data.

• learn how to develop effective policies here.

Data Subject Rights

Accountability is also closely linked to data subject rights. Organisations must uphold individual rights, responding to requests promptly and transparently. There are a range of rights people can exercise under the GDPR. There is a high risk of regulatory action if data controllers find it difficult to comply with people’s rights fully, and in a timely manner.

Challenges in Implementing Accountability

While accountability is a central tenet of the GDPR, there are challenges in its implementation. Overcoming hurdles, especially in the face of data breaches, requires dedication and expertise.

Accountability isn’t a one-time effort. It’s an ongoing commitment to maintaining data protection standards, evolving with the regulatory landscape, and conducting periodic audits and updates.

Ensuring accountability can involve:

• training staff in their GDPR responsibilities

• appointing key roles such as a Data Protection Officer

• regular audits of GDPR compliance

• benchmarking standards against industry best practice

Conclusion: Embracing the Principle of Accountability

In the complex realm of data protection, accountability serves as a pillar of GDPR compliance. Its far-reaching impact extends to every aspect of data handling, from data collection to cross-border transfers and individual rights. Accountability is not just a regulatory requirement; it’s a commitment to safeguarding personal data and upholding the fundamental principles of data protection. The journey towards accountability is ongoing, but it’s a journey that leads to enhanced data security, trust, and compliance with the GDPR.