When personal data are processed, who is ultimately responsible for demonstrating compliance with the GDPR?

The General Data Protection Regulation (GDPR) establishes the principle of accountability in Article 5(2). This principle explicitly states, "The controller shall be responsible for, and be able to demonstrate compliance with" the data protection principles. Furthermore, Article 24(1) mandates that the controller must implement appropriate measures to ensure and demonstrate that processing is performed in accordance with the Regulation. The controller determines the purposes and means of processing, and therefore holds the primary and ultimate responsibility for ensuring the entire processing activity is lawful and for demonstrating this compliance to supervisory authorities.

A. The data protection officer (DPO) advises the controller/processor and monitors compliance; they are not personally or ultimately responsible for the organization's compliance.
B. The supervisory authority is the independent public body responsible for monitoring the application of the GDPR and enforcing it, not for an organization's compliance.
C. While a processor has direct legal obligations under the GDPR, the controller retains ultimate responsibility for the processing and must ensure the processor provides sufficient guarantees.

1. Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union, L 119/1.

Article 5(2): "The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’)."

Article 24(1): "Taking into account the nature, scope, context and purposes of processing... the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation."

Article 4(7): Defines the 'controller' as the entity which "determines the purposes and means of the processing of personal data."

2. European Data Protection Board (EDPB). (2021). Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 2.1.

Paragraph 15: "The controller is the entity that has the decision-making power with respect to the processing... This responsibility comes with the role of controller."

Paragraph 36: "The controller is responsible for compliance with all data protection principles set out in Article 5 GDPR... The controller must also be able to demonstrate compliance with the data protection principles (accountability)."