Data Protection Roles, Responsibilities and Accountability
Domain 2 - Roles, responsibilities and accountability
This domain tests who decides, who executes, who advises, and who can prove compliance. Questions often hinge on controller and processor boundaries, DPO independence, and the evidence expected under the accountability principle.
Core rules
- Controller determines purposes and means; processor processes only on documented instructions. A joint controller arrangement requires an Art. 26 arrangement allocating responsibilities, but data subjects can exercise rights against either.
- DPO (Art. 37–39): mandatory in specified cases; may be external; must be involved properly, resourced, independent, report to highest management, and have no duties that create a conflict of interest. The DPO monitors compliance, advises, cooperates with the supervisory authority, and is a contact point, but does not own compliance.
- Accountability (Art. 5(2), 24): demonstrate compliance through policies, records (Art. 30), DPIAs, training evidence, contracts (Art. 28), and security measures (Art. 32).
- Processor duties: assist with rights and DPIAs, notify breaches, use only authorized sub-processors, delete or return data, and support audits.
Worked example
A company appoints its head of marketing as DPO and asks her to approve campaign targeting. This is flawed. The DPO role requires independence and no conflict with duties that determine processing purposes or means. Marketing leadership decides targeting, so the same person cannot monitor that decision. The company should separate the roles or appoint an external DPO, document the reporting line, and ensure the DPO is consulted on the campaign without owning the business decision.
Traps
Treating the DPO as the compliance guarantor; letting management instruct the DPO's advice; confusing joint controllership with processing; assuming a processor can decide retention; forgetting that accountability requires evidence, not just intent.