What does 'being able to demonstrate' mean in practice? Do we have to document everything?

Paragraph 1 requires measures that both ensure compliance and make it demonstrable, and recital 74 adds that you must also be able to show the effectiveness of those measures. The article does not prescribe a fixed format. Your documentation should show which measures you took and why, how you assessed the risk, and that the measures work.

Is a data protection policy mandatory for a small company?

Paragraph 2 says a policy is part of the measures where proportionate to the processing activities. So it depends on what you process and the risk involved, not only on the size of your company. Recital 75 lists situations that raise the risk, such as special categories of personal data, profiling, data of vulnerable people or large numbers of data subjects.

How often do we have to review our measures?

Paragraph 1 says the measures are reviewed and updated where necessary, without naming a fixed interval. A logical moment is any change in the nature, scope, context or purposes of the processing, or in the risk to data subjects (paragraph 1, recital 76). Record when you reviewed and what the outcome was, because that too is part of demonstrating compliance.

Article 24: Responsibility of the controller

Praxikon tracks Article 24 (Responsibility of the controller) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IVIn force since 25-05-2018

Article 24 places the core of accountability with the controller: you must implement appropriate technical and organisational measures to comply with the GDPR and to be able to demonstrate that you do (paragraph 1). Which measures are appropriate depends on the nature, scope, context and purposes of the processing and on the risk to people's rights and freedoms (paragraph 1, recital 76). Those measures are not a one-off: you review them and update them where necessary (paragraph 1). Where proportionate to the processing, this includes a data protection policy (paragraph 2). The article exists because the GDPR asks not only that you follow the rules, but also that you can show you follow them and that your measures are effective (recital 74).

Key term: Accountability: you must not only comply with the rules but also be able to demonstrate, through measures and documentation, that you do

Directly affects:controller

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.

Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.

Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the controller.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

For each processing operation, record the risks to the people concerned and the technical and organisational measures you have taken to address them (paragraph 1). Schedule a fixed moment to review and update those measures (paragraph 1). Adopt a data protection policy where the scale of your processing justifies it (paragraph 2); adherence to an approved code of conduct (Article 40) or an approved certification mechanism (Article 42) can be one of the elements by which you demonstrate compliance (paragraph 3).

Data Protection Officer

The article does not mention you, but recital 77 treats your indications as one of the sources the controller can use to determine appropriate measures and demonstrate compliance. You can therefore actively guide the risk assessment and the periodic review of measures (paragraph 1).

Compliance checklist

For each processing operation, the nature, scope, context and purposes have been assessed, together with the risk the processing poses to the rights and freedoms of data subjects (paragraph 1).The risk has been assessed objectively for likelihood and severity, and it has been established whether there is a risk or a high risk (recital 76).Appropriate technical and organisational measures have been implemented and documented for each processing operation (paragraph 1).The documentation shows that processing is performed in accordance with the GDPR, including whether the measures are effective (paragraph 1, recital 74).The measures are reviewed at fixed moments and updated where necessary (paragraph 1).There is a data protection policy that is proportionate to the processing activities and that is actually implemented (paragraph 2).If the organisation adheres to an approved code of conduct (Article 40) or an approved certification mechanism (Article 42), this is recorded as an element of the accountability documentation (paragraph 3).

Related recitals

(74)

The responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller's behalf should be established. In particular, the controller ...

(75)

The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in p...

(76)

The likelihood and severity of the risk to the rights and freedoms of the data subject should be determined by reference to the nature, scope, context and purposes of the processing. Risk should be ev...

(77)

Guidance on the implementation of appropriate measures and on the demonstration of compliance by the controller or the processor, especially as regards the identification of the risk related to the pr...

Cross-references

Art. 40: Codes of conduct Art. 42: Certification

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (3)

25 January 2024 · C-687/21 · CJEU
MediaMarktSaturn
A document handed to a third party by mistake does not in itself prove that the measures were inadequate. A purely hypothetical risk of misuse is not damage.
14 December 2023 · C-340/21 · CJEU
Natsionalna agentsia za prihodite
A successful hack does not in itself prove that security fell short; the court assesses the measures concretely and the controller must prove they were appropriate. Fear of misuse can be non-material damage.
27 October 2022 · C-129/21 · CJEU
Proximus
Inclusion in public telephone directories requires consent within the meaning of the GDPR. A request to be removed from directories is an exercise of the right to erasure, and the directory provider must take reasonable steps to inform other providers and search engines.

Fines (2)

1 September 2023 · Data Protection Commission (Ireland)€345,000,000
TikTok: children's accounts public by default
Children's accounts were public by default and the Family Pairing feature was poorly safeguarded, while children were not properly informed. At the EDPB's direction, deceptive design choices were also found to breach the fairness principle.
Decision of 1 September 2023, announced on 15 September 2023. TikTok challenged the decision before the EU General Court (case T-1030/23) and the Irish High Court.
2 September 2022 · Data Protection Commission (Ireland)€405,000,000
Instagram: children's data public by default
Children aged 13 to 17 could run business accounts that published their email address or phone number, and children's personal accounts were public by default. At the EDPB's direction, an infringement of the legal basis for processing was also found.
Decision of 2 September 2022, announced on 15 September 2022. Meta appealed to the Irish High Court.

Checked on 5 November 2026

Frequently asked questions

← Art. 23: Restrictions Art. 25: Data protection by design and by default →

Connections

Themes where this returns

Who is responsible: roles in both laws

The counterpart in the other law

Case law

Russmedia: an online marketplace operator is controller for personal data in adverts and must check before publication
2025-12-02 · final, Hof van Justitie van de EU (Grote kamer), X tegen Russmedia Digital SRL en Inform Media Press SRL

Guidelines

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default
2020-10-20 · final, European Data Protection Board (EDPB)

Analysis

AI governance through the privacy function: from intake to DPO oversight
2026-10-14