Accountability
Art. 5(2) GDPR — you must be able to demonstrate compliance
TL;DR
The controller is not only required to comply with the GDPR — the controller must also be able to demonstrate that compliance (reversal of the burden of proof).
What is Accountability?
Mandatory documents for demonstrating accountability:
- Record of processing activities (Art. 30)
- Data processing agreements (Art. 28)
- DPIAs (Art. 35) where required
- Documentation of technical and organisational measures (Art. 32)
- Training records
- Personal Data Breach log (Art. 33(5))
- Consent log
Practical example
A supervisory authority asks, following a Personal Data Breach, whether you reported it in time. You say 'yes, on day X'. The burden of proof lies with you — so you have to produce the log and the email trail.
Frequently asked questions
What happens without evidence?
A presumption of infringement (BVerwG 6 C 6.20). Fine under Art. 83(4)(a) — up to EUR 10 million.
How long must records be kept?
For as long as proceedings are possible (limitation period 3 years, special AGG cases 6 months).
Is an Excel list sufficient?
Yes, if it is complete, dated and verifiable.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are a compliance specialist, not a law firm. For legally binding information, consult a qualified lawyer.