Data Protection Governance, Accountability, and Training
Accountability is operationalised through governance: policies, records of processing (ROPA), a DPO where required, privacy by design, training, audits, and vendor oversight. The DPO advises, monitors, and liaises with the regulator; independence matters - the DPO should not be the person deciding processing purposes. A ROPA should capture purposes, categories, recipients, transfers, retention, and security measures.
Privacy by design and by default means embedding protections into systems and minimising data collection by default. Training must be role-appropriate and evidenced (completion records, refresher cycles). Governance also includes handling complaints, maintaining breach logs, and conducting periodic audits.
Traps
- Assuming a DPO is always mandatory - it depends on scale and processing type.
- Treating a policy as sufficient evidence of compliance; implementation evidence is needed.
- Confusing the DPO's advisory role with executive decision-making.
- Ignoring supplier due diligence as part of governance.
Rule of thumb
If a regulator asked "show me," could you produce the ROPA, training records, DPIA register, and breach log within a day? If not, governance is incomplete.
Worked example: A startup appoints its CTO as DPO and also as the decision-maker on marketing data. This creates a conflict of interest. The fix is to appoint an independent DPO or reassign decision-making, and to document the change.