The accountability principle puts the burden on the organisation: you must be able to demonstrate compliance. In practice that means evidence that exists before anyone asks for it.
What to keep
| Area | Evidence |
|---|---|
| Lawful basis | Record of processing, legitimate interestsLegitimate interestsA lawful basis needing a three-part test: a legitimate purpose, necessity, and a balance against the individual's interests and rights. assessments, consent records |
| Transparency | Dated versions of every privacy notice |
| Rights | Request log with dates, extensions, stop-the-clock periods and outcomes |
| Risk | Screening decisions and completed DPIAsDPIAData protection impact assessment: a structured risk assessment required before processing likely to result in a high risk to people. |
| Security | Risk assessments, access reviews, test results |
| Breaches | The breach register, including breaches not reported and why |
| ProcessorsProcessorProcesses personal data on a controller's instructions, such as a cloud host or payroll bureau, with its own security and breach duties. | Contracts, due diligence and audit results |
| Transfers | Routes and data protection testData protection testThe DUAA test for international transfers: whether protection in the destination is not materially lower than in the UK. A different wording from the EU's essentially equivalent standard. assessments |
| Training | Completion by role |
| Complaints | Log, acknowledgements within 30 days, outcomes |
Auditing your own programme
An internal audit plan should cover each area over a cycle, prioritised by risk. Test samples, not just policies: pick ten access requests and check the dates, pick five processors and read the contracts. Record findings, owners and dates, and follow up.
Auditing processors
Article 28 requires processors to make available the information needed to demonstrate compliance and to allow audits. Use it proportionately: questionnaires and certifications for low-risk suppliers, on-site or remote audits for high-risk ones. Keep the results.
What the regulator can require
The regulator can issue information notices, assessment notices and, since 2026-02-05, interview notices, and can apply for a warrant to enter and inspect. Destroying or falsifying information to frustrate a notice is an offence (DPA 2018 s.148), and so is a false statement in response to an information or interview notice (ss.144 and 148C). Obstructing a warrant is an offence too.
The test
Imagine the regulator asks tomorrow how you handled your last five access requests, your last breach and your newest processor. If the answer takes more than a day to assemble, the evidence is not organised well enough.