A supervisory authority asks a non-exempt controller for its records of processing activities and learns that none exist. Which accountability conclusion follows?
Select an answer to reveal the explanation.
Short Explanation
When the inspector asks for the inventory and the cupboard is empty, that is not a paperwork vibe check — it is a missed accountability duty. Controllers (where Article 30 applies) need real records, not hallway memory. Calling RoPA ‘optional brochureware’ is the wrong take.
Full Explanation
Article 30 requires controllers—and processors, with their own content—to maintain records of processing activities, subject to limited enterprise exemptions that do not erase the duty for many organisations, especially where processing is not occasional or involves special categories or higher risk. A supervisory authority request that reveals no records where Article 30 applies is an accountability failure. Records of processing are how organisations demonstrate what they do with people’s data in civic and commercial settings.
Verbal staff recollections do not replace Article 30 documentation. Records are not optional marketing collateral with no legal weight. Controllers are not excused on the theory that only processors must keep records; both have duties under Article 30.
Exam caveat: know the high-level Article 30 content—purposes, data categories, recipients, transfers, retention points, and security measures—and that exemptions are narrow. Absence of required records is itself a compliance finding independent of other breaches.
Operational check: build or repair the record of processing activities, assign owners per processing activity, reconcile entries to live systems on a recurring schedule, and treat supervisory record requests as a readiness drill the organisation should already be able to pass.