Article 24

Responsibility of the controller

Chapter 4 | Controller and Processor | 📖 3 min read

1. Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.

2. Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.

3. Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used to demonstrate compliance with the obligations of the controller.

Understanding This Article

Article 24 is the cornerstone of GDPR accountability. It transforms data protection from a set of abstract rules into concrete organizational responsibilities. The key phrase is 'ensure and be able to demonstrate' - compliance isn't enough; you must prove it.

Paragraph 1 - Risk-Based Accountability:

Controllers must implement 'appropriate' technical and organizational measures. What's 'appropriate' depends on five factors:

Nature: Type of processing (e.g., profiling vs. simple storage)
Scope: Scale of processing (millions vs. hundreds of data subjects)
Context: Processing circumstances (healthcare vs. marketing)
Purposes: Why data is processed
Risks: Likelihood and severity of risks to individuals

The risk-based approach means high-risk processing requires stronger measures. A hospital processing health data needs more robust safeguards than a newsletter service processing email addresses.

Critically, controllers must demonstrate compliance through documentation, policies, training records, audit logs, impact assessments, and other evidence.

Measures must be reviewed and updated - compliance isn't a one-time project but an ongoing process.

Paragraph 2 - Data Protection Policies:

Where proportionate, controllers should implement data protection policies. This means documented procedures covering data protection practices, roles, responsibilities, and processes.

Paragraph 3 - Compliance Demonstration:

Adherence to:

Codes of conduct (Article 40): Industry-specific guidelines
Certification mechanisms (Article 42): Independent verification schemes

can serve as evidence of compliance, though doesn't guarantee it.

Key Points

Controllers must implement appropriate technical and organizational measures for GDPR compliance
Must be able to demonstrate compliance (documentation required)
Risk-based approach: measures should reflect processing risks
Must review and update measures regularly
Should implement data protection policies where proportionate
Compliance can be demonstrated through codes of conduct or certifications

Practical Application

Technical Measures Examples:

Encryption at rest and in transit
Access controls and authentication systems
Pseudonymization and anonymization tools
Audit logging and monitoring
Secure backup and recovery systems
Data loss prevention (DLP) tools
Privacy-enhancing technologies

Organizational Measures Examples:

Data protection policies and procedures
Staff training and awareness programs
Privacy impact assessments
Records of processing activities (Article 30)
Incident response plans
Vendor management procedures
Data protection governance structure
Regular audits and reviews

Risk-Based Approach Example:

Low Risk: Company newsletter (names + emails only)

Basic encryption, standard access controls
Simple privacy notice
Basic training for marketing staff
Annual policy review

High Risk: Healthcare provider (sensitive health data)

End-to-end encryption, multi-factor authentication
Role-based access controls, audit trails
Comprehensive data protection policies
Regular staff training and testing
Data protection impact assessments
Appointed data protection officer
Regular security audits and penetration testing
Incident response team and procedures

Documentation for Demonstrating Compliance:

Data protection policies and procedures
Records of processing activities (Article 30)
Data protection impact assessments (Article 35)
Training records and materials
Processor contracts (Article 28)
Breach logs and notification records
Data subject request logs and responses
Audit reports and review records
Evidence of privacy by design implementation
Consent records (where applicable)

Review and Update Process:

Schedule regular reviews (at least annually)
Trigger reviews after: new processing activities, breaches, technology changes, legal changes
Update measures based on: emerging threats, new technologies, lessons learned
Document review dates and changes made

Common Mistakes:

Treating compliance as a one-time project, not ongoing process
Implementing generic measures without risk assessment
Failing to document compliance efforts
Not reviewing or updating measures
Lacking clear accountability within organization

Understanding This Article

Key Points

Practical Application

Related Recitals

Related Articles in Chapter 4

Popular Articles