What all Businesses must know about Accountability under the GDPR

| Malcolm Adams Last updated 3 Apr, 2022

Accountability is a fundamental tenet of the GPDR (General Data Protection Regulation). GDPR Accountability necessitates that organizations accept responsibility for compliance and demonstrate their actions.

The principle was implied in the GDPR’s predecessor in the United Kingdom, the Data Protection Act of 1998, but the GDPR goes further, stating specific procedures that organizations must take.

Below, we explain why accountability is vital for GDPR success.

Why Accountability matters

The accountability principle of the GDPR applies to two distinct areas of compliance.

The first is self-explanatory: organizations are accountable for how they process personal data.

There are no exemptions for compliance. You must be prepared to demonstrate compliance whenever required, such as when your supervisory authority investigates a complaint or you have a breach of data.

This covers GDPR compliance as an obligation. A set of standards that organizations must follow to avoid disciplinary action.

However, documenting your compliance policies allows your organization to improve its relationships with customers and third parties by demonstrating that you take data security seriously.

How to be accountable under the GDPR

Organizations should take several actions to demonstrate accountability under the GDPR:

Create data protection policies

Everything an organization does to maintain security, from deploying new technology to constructing physical barriers, is contingent on employees using those systems correctly.

Data protection rules ensure this by providing personnel with guidelines to follow.

Policies can also govern employees’ general behaviour in the workplace, providing guidance on topics such as permissible password management, Internet use, and remote access.

Include data protection by default

The GDPR’s version of ‘privacy by design’ requires organizations to assess information security risks at the outset of any processing activity and business practice.

The goal is for organizations to anticipate potential problems before committing to a project. This allows them to identify the best solution rather than the one that will work around the present system.

Establish contracts between data processors and data controllers

In simple terms, a data controller is an entity that decides what personal information to handle and the criteria for its collection – what lawful basis applies, how long the data will be held, and so on.

A data processor is an entity that collects and keeps this information, and it must do so per the requirements of the data controller.

In many circumstances, organizations will fulfil both responsibilities, but in others, the data controller will contract with a third party to process the information.

The two parties must write a contract outlining their respective responsibilities when this occurs. This safeguards that all parties understand what is expected and makes it easier to determine who was to blame in a data breach.

Implement appropriate security measures

To mitigate risks, the GDPR stipulates, somewhat vaguely, that “appropriate technical and organizational measures” are required.

It does not go into particular because best practices always improve in response to new technology and dangers.

Policies and employee training are examples of organizational measures, although technology measures might vary widely depending on how your organization runs.

Most people require antivirus, anti-malware software, network monitoring solutions, and vulnerability scans. Encrypting personal data – especially when it’s in transit – and employing Cloud storage providers are also likely to be beneficial.

After a risk assessment, you can determine which other technology solutions are appropriate.

Record and report data breaches

Every security incident must be documented. It must be reported to your supervisory authority within 72 hours if it threatens data subjects’ rights and freedoms.

Reportable risks are when affected individuals incur economic or social harm (such as discrimination), reputational damage, or financial losses.

Appoint a data protection officer

DPOs (data protection officers) are independent specialists who monitor and advise organizations on their data protection procedures and how to comply with data protection laws and regulations.

If an organization is a public authority or entity, conducts frequent and systematic monitoring of data subjects, or processes specific categories of personal data on a large scale, it is necessary to appoint a Data Protection Officer (DPO).

As a result of the assistance provided by a data protection officer, many organizations would benefit from hiring one even if they are not legally obligated to do so.

Respond to data subject access requests

The General Data Protection Regulation (GDPR) improves individuals’ rights concerning how organizations utilize their data.

Individuals can submit SARs (subject access requests) – sometimes known as DSARs (data subject access requests) – to verify that their rights are respected.

In this case, they will be able to obtain copies of their personal data and further information concerning how their data is being processed, such as the data retention term and who the data has been (or will be) shared with.

DSAR responses are due within one month, and various processes must be completed. As a result, organizations require a process that guarantees that the information is submitted correctly and timely.

Complete data protection impact assessments (DPIA)

A DPIA, an acronym for data protection impact assessment, is a technique that assists organizations in identifying and mitigating risks when processing personal data.

A DPIA must be conducted whenever personal data processing poses a severe risk to persons’ rights and freedoms.

The GDPR does not provide a risk threshold. Still, it specifies three processing categories that always necessitate a DPIA: systematic and extensive profiling with significant impacts, large-scale use of sensitive information, and large-scale public monitoring.

Furthermore, the DPA (Data Protection Authority) states that DPIAs are required to introduce new technology, assess denial of service, and process biometric or genetic data.

It further stipulates that DPIAs should be performed when data matching, invisible processing, following an individual’s behaviour or movements, targeting vulnerable people or children for certain forms of processing, and processing poses the risk of physical damage.

GDPR Accountability is an ongoing task

We’ve included many actions here, and you’ll need to keep track of them all to ensure GDPR compliance success.

Because the way your organization operates and the dangers it confronts are constantly evolving, you must ensure that your procedures are appropriate for your current needs in order to be really accountable for them.