Information for businesses about the General Data Protection Regulation (GDPR)

Accountability

What is accountability under the GDPR?

Accountability is one of the GDPR principles and it essentially means that all data controllers are responsible for – and must be able to demonstrate compliance with – the other GDPR principles. Some of the actions which can help demonstrate compliance include:

  • implementation of data protection policies
  • cybersecurity measures and adoption of “data protection by design and default”
  • carrying out data protection impact assessments (DPIAs)
  • keeping records of processing activities
  • maintaining records of any data breaches
  • appointing a data protection officer (DPO)
  • written contracts with third data processors

When are Data Protection Officers (DPO) required under the GDPR?

Data controllers and processors are required (under art 37 GDPR) to appoint a Data Protection Officer (DPO) with “expert knowledge” of data protection law and practices if:

  • their core activities “require regular and systematic monitoring of data subjects on a large scale”
  • their core activities consist of large scale processing of “special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10“
  • they are a public authority or body

How can a Data Protection Audit help with complying with the GDPR?

Businesses can take steps towards demonstrating compliance with the GDPR principles by conducting a Data Protection Audit. This proves that they are aware of the GDPR principles, their duties under the GDPR and have considered any measures which are necessary to comply with the GDPR.

We provide a Data Protection Audit as part of our GDPR Toolkit – click here for details.

Top