Intro: What is meant by accountability, what is its function and what needs to be considered when implementing it?
To-Dos: What is the specific procedure for fulfilling accountability and related obligations?
Statements: What have the data protection supervisory authorities published on the subject of accountability?
The accountability obligation means that the controller must be able to prove that the other obligations of the GDPR (e.g. documentation obligation, fulfilment of data protection rights, transparency obligation) are complied with. For example, the controller should not only delete data in good time. They should also be able to prove that they are doing so.
In the case of deletion, a deletion concept could provide information on who deletes data when and how in the company. The fulfilment of rights could be demonstrated by means of guidelines that regulate exactly how to proceed in the event of an incoming data subject rights request.
The purpose of the accountability obligation is to be able to easily demonstrate to a requesting data protection supervisory authority that compliance with the GDPR obligation is taken seriously. The accountability obligation is therefore subject to fines. This means that even if the company fulfils all other data protection obligations but cannot prove that it does so, a fine can be imposed.
Implementation of all other obligations under the GDPR
Identification of methods that enable proof of fulfilment of obligations (e.g. creation of a data protection concept)
Structured provision of verification documents in the event of an enquiry by the responsible data protection supervisory authority and, if necessary, corresponding disclosure to this authority
>> Find out which other data protection obligations have to be considered with respect to European data protection law.
familiar with the characteristics of small and large companies
experienced in communicating with data protection authorities
active in data protection for over 10 years.