Evidence, not labels
Accountability is the ability to show why processing is permitted, how risks were assessed, which controls operate, who owns them, and what happened when the system changed.
Core records
| Record | Minimum engineering value |
|---|---|
| Processing inventory or ROPA | Connects purpose, people, data, systems, recipients, transfers, retention, and security measures |
| Data-flow map | Shows collection, transformation, storage, access, disclosure, export, backup, and deletion paths |
| Lawful-basis record | Explains the legal basis and any legitimate-interest or consent evidence |
| DPIA | Tests necessity, proportionality, risks to people, safeguards, residual risk, consultation, and approval |
| Processor register | Tracks role, contract, subprocessors, location, safeguards, security evidence, and exit plan |
| Retention schedule | Defines event-based deletion and legal-hold exceptions across active data and backups |
| Rights register | Shows intake, identity checks, systems searched, decisions, deadlines, and completion |
Privacy by design gate
Every material change should answer:
- Is each data field necessary for a named purpose?
- Is the default the least intrusive usable state?
- Can access, correction, export, restriction, and deletion work across the data flow?
- Are logs and telemetry minimized and access-controlled?
- Are retention and backup expiry technically enforceable?
- Do processor and transfer contracts match the architecture?
- Does the change create likely high risk that requires a DPIA?
DPIA trigger
Article 35 requires a DPIA where processing is likely to result in high risk to people’s rights and freedoms, particularly with new technologies and considering nature, scope, context, and purpose. The DPIA must happen before the high-risk processing begins, not after launch as audit paperwork.
Primary references
- Gdpr
- Accountability
- Ropa
- Dpia
- Privacy by design
- Governance
Note Metadata
Aliases: GDPR ROPA, GDPR DPIA, Privacy by Design
Source: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng