# Standards and Regulatory References

## Primary Legislation

### GDPR Article 5(2) — Accountability Principle
The controller shall be responsible for, and be able to demonstrate compliance with, Article 5(1) (the data protection principles). This is the foundational accountability obligation.

### GDPR Article 24 — Responsibility of the Controller
- **Art. 24(1)**: Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.
- **Art. 24(2)**: Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.
- **Art. 24(3)**: Adherence to approved codes of conduct (Art. 40) or approved certification mechanisms (Art. 42) may be used as an element to demonstrate compliance.

### GDPR Article 30 — Records of Processing Activities
Mandatory documentation of all processing activities — a core accountability measure.

### GDPR Article 35 — Data Protection Impact Assessment
DPIAs are both a risk management tool and an accountability measure, documenting the assessment of high-risk processing.

### GDPR Articles 37-39 — Data Protection Officer
The DPO plays a central role in the accountability framework through monitoring, advising, and reporting.

## Regulatory Guidance

### EDPB Position Paper on Accountability (2024)
The European Data Protection Board emphasised that accountability requires proactive measures, not merely reactive compliance. Key points:
- Accountability must be demonstrable through documented evidence.
- Organisational measures are as important as technical measures.
- Regular review and updating of measures is essential.
- Board-level awareness and engagement is expected.

### ICO Accountability Framework (UK)
The ICO published a comprehensive accountability framework tool covering ten categories:
1. Leadership and oversight
2. Policies and procedures
3. Training and awareness
4. Individuals' rights
5. Transparency
6. Records of processing and lawful basis
7. Contracts and data sharing
8. Risks and DPIAs
9. Records management and security
10. Breach response and monitoring

Each category includes expectations for organisations at different maturity levels.

### CNIL (France) Accountability Guidance (2023)
Emphasised documentation requirements and recommended that organisations maintain a structured accountability file that can be presented to the supervisory authority upon request, containing at minimum: governance documents, RoPA, DPIAs, DPAs, training records, and breach log.

## Enforcement Precedents

- **British Airways (ICO, 2020, GBP 20 million)**: The ICO found failures in accountability measures including inadequate security risk assessment, insufficient testing of security controls, and lack of multi-factor authentication. Demonstrated that accountability requires not just policies but operational effectiveness.
- **H&M Hennes & Mauritz Online Shop (Hamburg DPA, 2020, EUR 35.3 million)**: Extensive profiling of employees without documented lawful basis, no DPIA, no accountability measures for sensitive processing. Core accountability failures drove the severity of the fine.
- **Clearview AI (Italian Garante, 2022, EUR 20 million)**: No RoPA, no DPIA, no Art. 27 representative, no lawful basis documentation. Comprehensive accountability failure across all dimensions.

## ISO/IEC Standards

- **ISO/IEC 27701:2019** — Privacy Information Management System (PIMS): Extends ISO 27001/27002 to include privacy management controls. Sections 7.2 (Conditions for collection and processing) and 7.4 (Privacy by design) align with GDPR accountability requirements.
- **ISO/IEC 27001:2022** — Annex A Control 5.1 (Policies for information security) and 5.2 (Information security roles and responsibilities) support the governance layer of accountability.