Article 5(2) GDPR: "The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 ('accountability')."

The principle requires two elements (per WP29 Opinion 3/2010 on Accountability):

The need for the controller to take appropriate and effective measures to implement data-protection principles.
The need to demonstrate upon request that appropriate and effective measures have been taken.

Per Lazcoz & de Hert 2023 (Section 9):

"The principle enshrined in Article 5(2) GDPR is in our view the most pertinent GDPR principle since it is tied intimately to all 6 other GDPR principles (lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality). Accountability commands that controllers take responsibility for what they do with personal data, for compliance with all other GDPR principles and for demonstrate this compliance."

Accountability is the systemic glue binding the other six Art. 5(1) principles into an enforceable governance regime.

The reframe: human intervention as accountability tool

Lazcoz & de Hert's central argument: human intervention under Art. 22 should be understood not primarily as an individual right of the data subject, but as a procedural component of the controller's accountability duties.

"Lack of meaningful human intervention and abdicating one's responsibilities is inescapably linked to the principle of accountability introduced by the GDPR."
"Making humans intervene at different stages of ADM is a measure aimed at achieving appropriate human oversight of the system and appropriate human oversight contributes to hold controllers accountable."
DPIAs are framed as the operational tool of accountability — they are how the controller demonstrates that human intervention is meaningful.

Operational implications

Tool	Role under accountability
Document holding	Records of processing activities (Art. 30)
DPIA (Art. 35)	Demonstrates risk assessment + chosen mitigations
Security policies	Demonstrates technical/organisational measures (Art. 32)
DPO (Art. 37)	Independent supervisor function
Breach notification (Art. 33–34)	Demonstrates proactive incident management
Logs / execution traces	Demonstrates what actually happened — key for agentic AI per [[sources/2025-navaie-iapp-engineering-gdpr-compliance-agentic-ai

Connection to AI Act accountability

The AI Act's accountability model (Art. 16: provider obligations; conformity assessment; technical documentation Art. 11; logs Art. 12; quality-management system Art. 17; post-market monitoring Art. 72) parallels GDPR's accountability — but is risk-based on the AI system, not on personal-data processing. The two regimes' accountability concepts are not equivalent (per Lazcoz/de Hert footnote 57) and should not be confused.

concepts/gdpr-article-22 · concepts/dpia · concepts/automated-decision-making · concepts/eu-ai-act · concepts/human-oversight