What does accountability mean in data protection?

What it is

The accountability principle is backed by specific duties: data protection by design and default, records of processing, DPIAs, processor contracts, security, breach records and, where required, a data protection officer. Article 24 requires appropriate technical and organisational measures, including policies, proportionate to the risk.

What it requires

• Appropriate technical and organisational measures, reviewed and updated. UK GDPR Art 24
• Data protection by design and by default. UK GDPR Art 25
• A record of processing activities. UK GDPR Art 30
• A DPIA for likely high-risk processing. UK GDPR Art 35
• A record of every personal data breach, reported or not. UK GDPR Art 33(5)
• A complaints process for data protection complaints, from 2026-06-19. DPA 2018 s.164A

Who is responsible

The controller. Processors have parallel duties for their own records and security.

What it involves

1. Adopt policies proportionate to your processing.
2. Keep a record of processing and keep it current.
3. Assign responsibility, and appoint a DPO where required.
4. Train staff and record it.
5. Review and audit, and keep the evidence.

If it goes wrong

Regulatory

Failing to demonstrate compliance breaches Art 5(2), in the higher tier (up to £17.5 million or 4%). Missing records, DPIAs or contracts are separately in the standard tier. Poor accountability also weighs against you when the regulator sets the amount of any penalty.

Criminal

No offence for weak accountability as such.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.