Accountability means demonstrating compliance
It is not enough to comply. You have to be able to show you comply.
That is what turns data protection into records: the assessments, the decisions about lawful basis, the register of processing, the evidence that people were trained. Organisations that are genuinely careful but have written nothing down are in a weak position, because the obligation is evidential as well as substantive.
More on UK GDPR
- Lawful basis is the reason processing is permittedIt will not turn without the reason
- Consent is one lawful basis, not the default answerOne setting out of six
- Access rights concern personal data, not every documentThe lines about you, not the page
- Erasure is not an absolute delete buttonIt will not travel the whole way
- Data portability is narrower than a database exportOnly what fits the frame
- Rectification requires organisations to be able to correct inaccurate personal data wherever it is maintainedCorrect it once, then chase every copy