A privacy programme documents policies but never tests whether controls operate in practice. Which accountability improvement is most on-point?
Select an answer to reveal the explanation.
Short Explanation
A safety manual nobody ever checks against the factory floor is shelfware. Accountability means looking under the hood — audits that test whether controls work and then fixing gaps. Longer notices and fewer records do not replace that reality check.
Full Explanation
Accountability under Articles 5(2) and 24 is not satisfied by policy authorship alone. Controllers must implement appropriate technical and organisational measures and be able to demonstrate that those measures work—typically through periodic auditing, testing, monitoring, and remediation. A privacy programme that never checks whether controls operate in practice leaves residents and customers with paper promises. Civic and enterprise privacy teams should treat audit findings as fuel for fixes, not as optional theatre.
Replacing technical measures with a single privacy poster does not meet Article 24. Deleting records of processing to shrink audit surface worsens accountability. Longer privacy notices that attempt to outsource diligence to data subjects also fail the controller’s demonstrability duty.
Exam caveat: monitoring can include control testing, access reviews, deletion-job verification, and tabletop exercises for rights requests and personal-data breaches. Documentation should evidence outcomes and remediation, not only policy approval dates.
Operational check: schedule recurring privacy-control audits, track remediation to closure, sample-test retention and access controls against the notice and RoPA, and report metrics to leadership as part of the living accountability narrative.