The seven data processing principles: an operating procedure by role

01

The principles Article 5 of the GDPR imposes on processing

Article 5 of the GDPR lists six principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality. A seventh principle, accountability, requires the controller to be responsible for compliance with the first six and to be able to demonstrate it.

02

Why accountability changes how roles are organised

Article 5, paragraph 2, does not only ask for compliance with the principles but to demonstrate it. This shifts the work from a statement of intent to a set of evidence: who decides the purposes, who processes the data, who keeps proof of the choices made. The GDPR also provides that the controller reviews the impact assessment when the risk of the processing changes.

03

A procedure by role, from controller to processor

Steps

1. The controller defines determined, explicit and legitimate purposes before collecting data.
2. The controller verifies that the data collected is adequate, relevant and limited to what is necessary.
3. Whoever manages the data over time updates or promptly deletes inaccurate information.
4. The processor processes data only on documented instructions from the controller, unless a different legal obligation applies.
5. The controller reviews the impact assessment when the risk level of the processing changes.

04

Hypothetical example: an SME that outsources payroll management to an external supplier

Hypothetical example. A company outsources payroll processing to an external supplier. The controller documents the instructions given to the supplier, who acts as the processor. The processor ensures the confidentiality of authorized staff, adopts the required security measures and, at the end of the contract, deletes or returns the data according to the controller's choice.

05

Checks to make before considering a processing activity compliant

• The purposes of the processing are written and communicated, not just assumed.
• The data collected is limited to what is necessary for that purpose.
• There is a procedure to correct or remove inaccurate data.
• The contract with each processor includes documented instructions.
• The processor can demonstrate, with documents, compliance with its obligations.

06

How management software can support this procedure

A company can ask its software partner to configure traceability for who enters, modifies, or deletes personal data, with distinct roles for the controller and the processor. This is an operational choice, not a legal obligation tied to a specific tool.

It can also structure an internal record of purposes and retention periods, with periodic review linked to changes in the risk of the processing, so as to have evidence ready in case of an audit.

07

Common clarifications on the Article 5 principles

• The principles apply to every processing activity, regardless of company size, because Article 5 does not introduce size thresholds.
• Accountability requires concrete evidence: contracts, records, documented decisions, not just generic policies.
• The review of the impact assessment is not automatic every year, but necessary when the risk of the processing changes.

08

Practical next step

Map today the processing activities active in your company, assigning each one a controller, a processor (if external), and a written purpose: it is the first step to making accountability verifiable.