A supervisory authority asks a non-exempt controller for its records of processing activities and learns that none exist. Which accountability conclusion follows?
Select an answer to reveal the explanation.
Short Explanation
When the inspector asks for the inventory and the cupboard is empty, that is not a paperwork vibe check — it is a missed accountability duty. Controllers (where Article 30 applies) need real records, not hallway memory. Calling RoPA ‘optional brochureware’ is the wrong take.
Full Explanation
Article 30 requires controllers (and processors) to maintain records of processing activities, subject to a narrow SME exemption that does not cover higher-risk processing. Accountability under Article 5(2) includes being able to demonstrate compliance; RoPA is a primary artefact. Verbal recollection and ‘marketing only’ characterisations do not satisfy the obligation. Controllers are squarely in scope of Article 30 when it applies.