Accountability means being able to demonstrate compliance, not just achieve it. A maturity model is a way of asking, honestly, how far the organisation has got, and what evidence would convince an outsider.
Five levels
| Level | What it looks like | Evidence |
|---|---|---|
| Initial | Compliance depends on individuals; nothing is written | None reliable |
| Defined | Policies exist; roles named | Policies, a DPO or lead, a record of processing |
| Implemented | Processes run: DPIAsDPIAData protection impact assessment: a structured risk assessment required before processing likely to result in a high risk to people., rights handling, breach response | Completed DPIAs, request logs, breach register |
| Measured | Performance is tracked against targets | Response times, training completion, audit findings |
| Optimised | Lessons feed back into design | Changes made because of complaints, incidents and audits |
Most organisations sit between defined and implemented. The gap between “we have a policy” and “we can show it is followed” is where regulators find their findings.
What to assess
Use the areas the regulator’s accountability framework groups compliance into: leadership and oversight; policies and procedures; training and awareness; individuals’ rights; transparency; records of processing and lawful basis; contracts and data sharing; risks and DPIAs; records management and security; and breach response and monitoring. Score each area separately: an organisation can be mature on security and initial on rights.
Measures that mean something
- Percentage of subject access requestsSubject access requestPractitioner shorthand for exercising the right of access. Not a statutory phrase, and no particular form or wording is required to make one. answered within the month, and the trend.
- Number of breaches, time from discovery to decision, and repeat causes.
- DPIAs completed before launch, not after.
- Records of processing reviewed in the last year.
- ProcessorsProcessorProcesses personal data on a controller's instructions, such as a cloud host or payroll bureau, with its own security and breach duties. with current contracts and recent assurance.
- Complaints upheld, and what changed as a result.
Internal and external assurance
Self-assessment is useful and biased. Internal audit, an independent DPO review or external certification such as ISO/IEC 27701 adds credibility. None of them is required by law; all of them help demonstrate accountability.
When the regulator asks
The regulator’s first questions after an incident or complaint are about accountability: what did you have in place, and how do you know it worked? A maturity assessment done beforehand, with its action plan, is the best available answer.