A controller maintains polished privacy policies that staff never f…

Question

A controller maintains polished privacy policies that staff never follow, and cannot show how processing complies in practice. Which accountability diagnosis is correct?

Accepted Answer

Accountability requires implementing appropriate measures and being able to demonstrate compliance — unused fiction documents do not suffice. — A shiny binder that nobody opens is theatre, not accountability. You have to run the controls and be able to show they work — not just decorate a SharePoint folder. Processors have duties too, but controllers do not escape by waving unread PDFs.

Answer

Shelfware documentation alone fully meets Article 5(2) accountability.

Answer

Demonstration duties apply only to processors under Article 28.

Answer

If policies exist on an intranet, operational effectiveness is legally irrelevant.

A controller maintains polished privacy policies that staff never follow, and cannot show how processing complies in practice. Which accountability diagnosis is correct?

Short Explanation

Full Explanation