When personal data are processed, who is ultimately responsible for demonstrating compliance with the GDPR?

Explanation:

Controller. Correct. The controller is responsible for adequate data security measures and must be

able to demonstrate compliance with the GDPR. (Literature:A, Chapter 2)

Data protection officer (DPO). Incorrect. The DPO has expert knowledge and assists the controller or

processor to monitor internal compliance.

Processor. Incorrect. The processor is the one who processes personal data according to the

instructions of the controller. The controller remains ultimately responsible though.

Supervisory authority. Incorrect. The controller needs to demonstrate compliance with the GDPR if

requested by the supervisory authority.