Data Protection in Companies - Accountability

Frau Rechtsanwaeltin Rejin Sherzad Ahmed, Do. 05 Februar 2026

---

The GDPR requires more than formal compliance. Companies must be able to demonstrate at any time that personal data is processed lawfully and that the legal requirements are implemented. This accountability obligation under Art. 5(2) GDPR is a standalone compliance standard: it is about verifiable processes, documented decisions, and clear responsibilities. Overall responsibility lies with management, not automatically with the data protection officer.

Art. 24 GDPR specifies this duty and requires appropriate technical and organizational measures to ensure that processing complies with the law. Which measures are necessary depends on the risk of the processing, meaning the nature, scope, context, and purposes of data processing. A generic template is therefore insufficient. In practice, this means: data protection must be embedded in processes, documented, and reviewed regularly.

Accountability is also subject to administrative fines (Art. 83(5) GDPR). Gaps in documentation or missing evidence can be sanctioned even if no specific data protection violation is proven. The European Court of Justice has reinforced this duty: it applies even in cooperation between different entities, even when there is no joint controllership under Art. 26 GDPR (ECJ, 27.10.2022 - C-129/21). Whenever personal data is exchanged, controllers must check and document that GDPR requirements are met and, if necessary, inform other parties involved.

An example Template

Measures to implement data protection requirements
Company ... aims to implement the data protection requirements of the EU General Data Protection Regulation (GDPR).
This document records the individual steps taken to implement the legal requirements.
It provides an overview of the formal requirements and demonstrates compliance with the organizational and technical measures to protect personal data.
The document is updated regularly and is available on the intranet at ...
Version: ...
Date: ...
Signing, responsible person: ...
Data Protection Officer: ...

Depending on the processing activity, the measures, the description, the program version number and last version, the review (by whom and when), and the subsequent assessment must be recorded in a table and documented as evidence.

Please contact me for detailed legal advice.

---

tags: #Data Protection #GDPR #compliance #en