Learning 3 - Individual rights and accountability
1. Section 3: Individual rights and accountability
1.3. 3.3 Accountability, transparency and privacy by design
3.3 Accountability, transparency and privacy by design
The records, controls and design choices that demonstrate compliance.
Demonstrating compliance
Accountability measures may include:
- records of processing activities and data inventories;
- privacy notices and communication records;
- lawful-basis and legitimate-interest assessments;
- retention schedules and deletion procedures;
- training, role-based access and confidentiality controls;
- incident and breach records;
- contracts with processors;
- DPIAs and risk decisions; and
- audit, monitoring and governance reporting.
Privacy notices
Privacy information should be concise, transparent, intelligible, easily accessible and written in clear language. It normally explains the controller, purposes, lawful bases, recipients, transfers, retention, rights and complaint routes.
Storage limitation and retention
“Keep everything just in case” is not an acceptable retention strategy. Organisations should define evidence-based retention periods, review data and securely delete or anonymise it when no longer needed.
Data protection by design and default
Privacy and security should be considered early enough to influence system design, procurement, forms, permissions, default settings, testing and deployment. Default settings should use the minimum data needed for the purpose.
Knowledge checkpoint
Answer each question before opening the suggested answer.
1. What is the difference between compliance and accountability?
Suggested answer: Compliance means meeting the requirements; accountability also means taking responsibility and being able to demonstrate how they are met.
2. Why is a retention schedule useful?
Suggested answer: It links categories of records to justified retention periods, review points and disposal actions.
3. When should privacy be considered in a project?
Suggested answer: From the earliest planning and design stages, not after deployment.
Official reference points
Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.