Accountability in Practice: Risk, Security, Breaches, and Governance

Accountability is demonstrable

Recital (74) says responsibility and liability of the controller should be established for processing done by the controller or on its behalf.

"the controller should be obliged to implement appropriate and effective measures and be able to demonstrate the compliance of processing activities with this Regulation"

Appropriate depends on context

Measures should reflect the processing's nature, scope, context, purposes, and risks to rights and freedoms.

What can make risk serious?

Recital (75) lists harms such as discrimination, identity theft, financial loss, reputational damage, loss of confidentiality, profiling, vulnerable persons' data, and large-scale processing.

Risk versus high risk

"Risk should be evaluated on the basis of an objective assessment, by which it is established whether data processing operations involve a risk or a high risk."

Scenario

A university wellbeing platform stores stress and health-related information, appointment notes, and engagement data. It flags students who may need support.

Risk indicators from Recital (75)

Relevant indicators include health data, evaluation or prediction of personal aspects, potentially vulnerable data subjects, and processing affecting many students.

Use an objective assessment

Do not label risk only from the beneficial purpose or only from one data category. Assess nature, scope, context, purposes, likelihood, and severity.

Show the measures

Accountability means being able to demonstrate decisions and measures: restricted access, correction routes, retention choices, and limits on secondary use.

Sources of practical guidance

Recital (77) says approved codes, certifications, Board guidelines, and a data protection officer's indications could help identify, assess, and mitigate risk.

Design and default

"the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default."

Recital (78) examples include minimisation, pseudonymisation as soon as possible, functional transparency, user monitoring, and improved security features.

Clear allocation

Recital (79) calls for clear responsibilities, including joint controllers and processing carried out on behalf of a controller.

Processor governance and records

Recitals (81)-(82) address sufficient processor guarantees, a binding processing arrangement, return or deletion after processing where applicable, records, and cooperation with supervisory authorities.

The Recital (83) sequence

Evaluate risks inherent in processing, then implement measures to mitigate them. Encryption is an example of a possible measure.

Appropriate security is contextual

Security should include confidentiality and should account for the state of the art, implementation costs, risks, and the nature of the personal data.

The threat list

Consider accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and unauthorised access to transmitted, stored, or otherwise processed data.

Security is broader than encryption

Encryption can help with confidentiality. It does not alone solve every problem, including accidental deletion, improper changes, or overly broad access.

When a DPIA is in view

Recital (84) addresses processing likely to result in a high risk to rights and freedoms.

"the controller should be responsible for the carrying-out of a data protection impact assessment to evaluate, in particular, the origin, nature, particularity and severity of that risk."

What the DPIA informs

Its outcome should be taken into account when selecting measures to demonstrate compliant processing.

Residual high risk

If high risk cannot be mitigated by appropriate measures in light of available technology and implementation costs, supervisory-authority consultation should occur before processing.

Before, not after

Recital (90) says the DPIA should be carried out prior to processing and should include proposed safeguards and mechanisms for mitigation, protection, and demonstration of compliance.

External currency note

The Digital Omnibus proposal, COM(2025) 837 final of November 19, 2025, is not in force as of July 25, 2026. Existing GDPR requirements remain applicable.

City-camera scenario

A transport authority uses networked optic-electronic cameras across stations and generates travel-pattern alerts for review.

"A data protection impact assessment is equally required for monitoring publicly accessible areas on a large scale"

Other Recital (91) signals

Systematic and extensive profiling for decisions about individuals, certain sensitive-data processing, large-scale operations, and operations impairing rights or services are all identified.

Keep the exception precise

Patients or clients of an individual physician, other healthcare professional, or lawyer should not be considered large-scale processing; in such cases a DPIA should not be mandatory.

Residual risk means consultation

Under Recital (94), inability to mitigate high risk by reasonable means, considering available technologies and costs, points to consultation before processing starts.

Start with awareness

Recital (85) concerns what happens as soon as a controller becomes aware that a personal data breach has occurred.

Notify without undue delay and, "where feasible, not later than 72 hours after having become aware of it".

Do not omit the exception

No notification is needed where the controller can demonstrate, under accountability, that the breach is unlikely to result in a risk to rights and freedoms.

A different threshold for communication

"The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of the natural person"

Communicate useful information

The communication should describe the breach's nature and give recommendations for mitigating potential adverse effects.

External currency note

COM(2025) 837 final proposes a 96-hour, high-risk notification model, but remains proposed as of July 25, 2026. The existing 72-hour GDPR rule remains applicable.

When expert assistance is identified

Recital (97) covers public authorities with stated exceptions, large-scale regular and systematic monitoring as a core activity, and large-scale sensitive or criminal-data processing as a core activity.

Core does not mean ancillary

For private-sector controllers, core activities are primary activities and do not include merely ancillary personal-data processing.

"Such data protection officers, whether or not they are an employee of the controller, should be in a position to perform their duties and tasks in an independent manner."

Codes of conduct

Associations and representative bodies should be encouraged to create codes that facilitate effective application and can calibrate obligations to likely risk.

Certification

"the establishment of certification mechanisms and data protection seals and marks should be encouraged" so people can quickly assess protection levels.