What is Accountability
First, let us establish what the principle of accountability entails. Article 5(2) of the GDPR states that the data controller is responsible for complying with the principles regarding the processing of personal data and must be able to demonstrate compliance. This is precisely what accountability means – the data controller must be able to document the implementation of the principles related to personal data protection, for instance, in the event of a GDPR audit or a supervisory authority inspection, as well as upon request from the individuals whose data is being processed.
How to Demonstrate Compliance with GDPR
Let us recall that the principles related to personal data protection include, among others:
- lawfulness, fairness, and transparency of data processing,
- purpose limitation,
- data minimization,
- accuracy of data,
- storage limitation,
- integrity and confidentiality.
Implementing these principles is only possible if the organization has established appropriate procedures related to personal data protection, such as: data protection policy, Data Protection Impact Assessment (DPIA), or a data breach reporting procedure. However, it is not sufficient to simply print a document titled, for example, data protection policy and place it in a binder. The organization must prove that it actually complies with the provisions of the GDPR. Demonstrating adherence to the principle of accountability is, after all, the responsibility of the data controller.
To this end, the data controller should first compile a list of documents based on which the organization processes personal data. At the top of this list are usually data protection policies, regulations (e.g., video surveillance), or records of processing activities.
Next, the data controller must ensure that there is written evidence that a given procedure or record has been implemented within the organization and that employees or individuals responsible for carrying out these tasks or overseeing them have been informed of this fact. If the data controller does not have such documentation, they will not be able to demonstrate compliance with the principle of accountability, and consequently, will not be able to indicate how they adhere to the provisions of the GDPR.
The Principle of Accountability in Practice
How should the principle of accountability be approached in practice? When an organization introduces a new document, the significance of which indicates, for example, the necessity of adopting a resolution by the management board, in addition to adopting the resolution itself, an annotation can be made on the first page indicating that this is the first version of the document, introduced by the resolution dated… (indicate the date). When dealing with a modification of a document, such a modification can also be made by a resolution, and an annotation can be added to the document stating that this is a subsequent version, following changes introduced by the resolution, along with the appropriate date.
It is very important not to forget the necessity of demonstrating that the individuals who are the recipients of the provisions contained in the document have been acquainted with it. For example, when the document concerns the introduction of a video surveillance regulation in the workplace, the data controller should document that the entire workforce has familiarized themselves with this regulation. How can this be done? In addition to introducing the document in accordance with the principles provided in the internal regulations of the organization and in labor law provisions (Article 222 of the Labor Code), the employer must fulfill the information obligation towards the individuals whose data will be processed (Articles 13 and 14 of the GDPR).
PROMOTIONAL OFFER
Professional DPO Support
"Do you need support? During the conversation, you will learn practical solutions and receive a special offer for ongoing cooperation.
Furthermore, to demonstrate the principle of accountability, a short meeting can be organized, during which information about the planned date for introducing the new regulation will be conveyed. Employees present at the meeting should sign the attendance list with their first and last names – this list will serve as documentation for the data controller evidencing that the principle of accountability is being implemented. Another example: a company that will be updating the provisions of its privacy policy should send (e.g., via email) information about this to all clients and then generate a list of recipients of this message. The report does not need to be printed. It is important that its electronic form can be easily located in case of, for example, an audit or inspection.
For the data controller, it is crucial to demonstrate that a given procedure has been implemented and that the individuals to whom this procedure applies have had the opportunity to familiarize themselves with the document describing it. Furthermore, the data controller must indicate how these tasks have been carried out.
Activity of the Data Controller
The data controller must also demonstrate their activity and continuity of action. For example, when receiving an updated records of processing activities from the Data Protection Officer's team, they should review and accept this document. Subsequently, they should make an annotation in the register indicating the date the change was made, what it pertained to, and that it was approved by them following the recommendation of the Data Protection Officer's team. It is important to remember that not every document needs to be shared with a wider group of individuals. In this case, it suffices for the data controller or designated individuals to document the implementation of the change. This way, the data controller will always be able to specify how and based on which document a given change occurred, thereby demonstrating compliance with the principle of accountability.
In implementing the principle of accountability, the data controller must also remember to document many other obligations related to processes involving personal data. Among the most important are: having appropriate consents for the processing of personal data, having signed data processing agreements by both parties (the data controller and the data processor), maintaining a register of personal data breaches, maintaining records of processing activities, having documentation from the conducted risk analysis or Data Protection Impact Assessment. There could be many more examples of the data controller's actions in the area of implementing the principle of accountability. However, in every case, it is essential for the organization to be able to identify those actions that are associated with the necessity of having documents certifying that a given procedure has been implemented, as well as indicating the basis on which this occurred.
Summary
The principle of accountability is one of the most important principles addressed by the GDPR. The data controller bears the responsibility for the proper implementation of procedures and for documenting this fact. It should also be remembered that the GDPR imposes on the data controller the obligation to comply with other principles related to data processing. In the event of a violation of any of these principles, the data controller may be held liable. However, with the cooperation of the entire organization, the principle of accountability should not be difficult to implement. The most important thing is to be able to document how we comply with GDPR regulations, based on which documents, and using which tools or procedures.
Check what you remember - a reward for the correct answer !
The principle of accountability means that the organization:
