Governance, Accountability and Compliance
Domain 4: Governance, Accountability and Compliance
This domain tests how an organisation proves and sustains compliance: governance structures, policies, training, monitoring, audit, and evidence. The exam expects you to connect accountability under Article 5(2) and Article 24 to concrete management systems rather than to a single policy document.
Core governance elements
- Accountability: the controller must be able to demonstrate compliance. Evidence includes records of processing, DPIAs, breach logs, training records, vendor assessments, and audit results.
- Governance roles: senior management owns risk appetite; the DPO monitors and advises independently; business owners implement controls; internal audit provides assurance.
- Policy framework: policies must be approved, communicated, reviewed, and linked to procedures such as subject access handling and incident response.
- Training and awareness: role-based training with completion tracking and refresher cycles.
- Monitoring and audit: KPIs, periodic audits, DPIA register reviews, and remediation tracking.
- Processor governance: due diligence, written contracts, and ongoing oversight of vendors.
Worked example
A board asks how the company can demonstrate accountability. The privacy lead maps evidence to obligations: a ROPA covering all processing, a DPIA register with decisions and mitigations, a breach log showing notification timings, training completion by role, vendor assessments with contract clauses, policy review dates, and internal audit findings with remediation owners. These are reported quarterly as KPIs. This shows Article 5(2) and Article 24 compliance because the organisation can evidence both design and operation of controls, not just intent.
Mark-losing traps
- Treating accountability as a policy folder rather than demonstrated practice.
- Appointing a DPO who also owns operational decisions, undermining independence.
- Running a one-off compliance project with no monitoring cycle.
- Ignoring processors in governance and audit scope.
- Confusing the DPO with the CISO or treating the DPO as the sole compliance owner.
- Collecting evidence once and never reviewing it.