An annual privacy audit finds that data-subject request workflows are broken. Leadership files the report for marketing and takes no corrective action. What does accountability most clearly require instead?
Select an answer to reveal the explanation.
Short Explanation
An audit that sits in a drawer is like a smoke-alarm test you ignore after it beeps. Accountability means fixing the dead DSR workflow—not framing the PDF for PR.
Full Explanation
When an annual privacy audit finds that data-subject request workflows are broken and leadership files the report for marketing without corrective action, accountability most clearly requires using the audit to drive remediation of defective DSR workflows, not cosmetic reporting. Access, erasure, and objection rights are civic tools; discovering they are broken and leaving them unrepaired leaves people without effective remedies and undermines demonstrable compliance. Publishing the raw audit only on social media without fixing processes fails by substituting publicity and optics for operational repair. Deleting audit findings so supervisory authorities cannot see gaps fails as accountability sabotage and destroys the evidence trail needed for improvement. Replacing the DPO every quarter regardless of findings fails by ritual personnel churn that does not restore statutory response timelines or quality. Exam caveat: internal audits support Articles 5(2) and 24 accountability only when findings produce owned corrective actions, retesting, and management oversight—filing a PDF is not remediation. Operational check: open tracked remediation items for each DSR defect, assign owners and deadlines aligned to Articles 12–15 timelines, retest end-to-end requests with sample subjects, brief leadership on closure evidence, and retain the audit-plus-fix pack for supervisory demonstration.