A controller maintains polished privacy policies that staff never follow, and cannot show how processing complies in practice. Which accountability diagnosis is correct?
Select an answer to reveal the explanation.
Short Explanation
A shiny binder that nobody opens is theatre, not accountability. You have to run the controls and be able to show they work — not just decorate a SharePoint folder. Processors have duties too, but controllers do not escape by waving unread PDFs.
Full Explanation
Article 5(2) accountability requires the controller to be responsible for, and able to demonstrate compliance with, the data-protection principles. Article 24 similarly demands appropriate measures and demonstrability. Polished privacy policies that staff never follow, without evidence that processing complies in practice, are shelfware—not accountability. Residents and customers are protected by implemented controls, training, and monitoring—not by intranet PDFs alone.
Shelfware documentation does not fully meet Article 5(2). Demonstration duties are not limited to processors under Article 28; controllers bear the primary accountability burden for their processing. Mere existence of policies on an intranet does not make operational effectiveness legally irrelevant.
Exam caveat: demonstration evidence includes records of processing, logs, training completion, audit results, DPIAs, contracts, and metrics matched to actual processing. Exams often contrast “paper compliance” with living compliance that can be shown to a supervisory authority.
Operational check: map each policy requirement to operating controls, test those controls on a schedule, remediate gaps with owners and deadlines, keep evidence packs ready for supervisory questions, and retire the assumption that elegant drafting equals GDPR compliance.