Accountability
Accountability is the principle in Art. 5(2) GDPR under which the controller is responsible for, and must be able to demonstrate, compliance with all data protection principles. It shifts the burden of proof onto the organisation: it is not enough to be compliant, you must be able to show it to a supervisory authority, an auditor or a business partner.
In practice, accountability is evidenced through documentation and governance: a record of processing activities, DPIAs for high-risk processing, data processing agreements with vendors, a breach register, policies, staff training records and, where required, the appointment of a Data Protection Officer (Art. 24, 30, 35 and 37 GDPR).
For life sciences organisations, accountability also intersects with ICH GCP requirements on documentation and audit trails. A sponsor that cannot produce its DPIA, its transfer assessments or its processor contracts during a due diligence or a regulatory inspection is, by definition, non-compliant even if no breach has occurred.
