The accountability principle found in Article 5, Section 2 of the GDPR requires data controllers to

take responsibility for complying with the GDPR and to be able to demonstrate their

compliance1. This means that data controllers must implement appropriate technical and

organisational measures to ensure and show that they process personal data in accordance with the

GDPR2. One of the measures that can demonstrate compliance with the accountability principle is

conducting regular audits of the data protection program. Audits are systematic and independent

assessments of the data processing activities and the data protection policies and procedures of an

organisation3. They can help to identify and address any gaps or risks in the data protection program,

as well as to verify the effectiveness and efficiency of the data protection measures3. Audits can also

provide evidence of compliance to the supervisory authorities and the data subjects, as well as to

enhance the trust and reputation of the organisation3. Therefore, conducting regular audits of the

data protection program is a way to demonstrate compliance with the accountability

principle. Reference: 1: CIPP/E study guide, page 15; Art. 5 GDPR; Accountability principle | ICO2:

CIPP/E study guide, page 16; Art. 24 GDPR; [Guide to accountability and governance | ICO]3: CIPP/E

study guide, page 91; [Auditing | ICO]; [GDPR Audits: What You Need to Know - IT Governance Blog].