Article 24 GDPR

← Article 24 - Responsibility of the controller →
Chapter 1: General provisions Article 1: Subject-matter and objectives Article 2: Material scope Article 3: Territorial scope Article 4: Definitions Chapter 2: Principles Article 5: Principles relating to processing of personal data Article 6: Lawfulness of processing Article 7: Conditions for consent Article 8: Conditions applicable to child’s consent in relation to information society services Article 9: Processing of special categories of personal data Article 10: Processing of personal data relating to criminal convictions and offences Article 11: Processing which does not require identification Chapter 3: Rights of the data subject Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject Article 13: Information to be provided where personal data are collected from the data subject Article 14: Information to be provided where personal data have not been obtained from the data subject Article 15: Right of access by the data subject Article 16: Right to rectification Article 17: Right to erasure (‘right to be forgotten’) Article 18: Right to restriction of processing Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing Article 20: Right to data portability Article 21: Right to object Article 22: Automated individual decision-making, including profiling Article 23: Restrictions Chapter 4: Controller and processor Article 24: Responsibility of the controller Article 25: Data protection by design and by default Article 26: Joint controllers Article 27: Representatives of controllers or processors not established in the Union Article 28: Processor Article 29: Processing under the authority of the controller or processor Article 30: Records of processing activities Article 31: Cooperation with the supervisory authority Article 32: Security of processing Article 33: Notification of a personal data breach to the supervisory authority Article 34: Communication of a personal data breach to the data subject Article 35: Data protection impact assessment Article 36: Prior consultation Article 37: Designation of the data protection officer Article 38: Position of the data protection officer Article 39: Tasks of the data protection officer Article 40: Codes of conduct Article 41: Monitoring of approved codes of conduct Article 42: Certification Article 43: Certification bodies Chapter 5: Transfers of personal data Article 44: General principle for transfers Article 45: Transfers on the basis of an adequacy decision Article 46: Transfers subject to appropriate safeguards Article 47: Binding corporate rules Article 48: Transfers or disclosures not authorised by Union law Article 49: Derogations for specific situations Article 50: International cooperation for the protection of personal data Chapter 6: Supervisory authorities Article 51: Supervisory authority Article 52: Independence Article 53: General conditions for the members of the supervisory authority Article 54: Rules on the establishment of the supervisory authority Article 55: Competence Article 56: Competence of the lead supervisory authority Article 57: Tasks Article 58: Powers Article 59: Activity reports Chapter 7: Cooperation and consistency Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned Article 61: Mutual assistance Article 62: Joint operations of supervisory authorities Article 63: Consistency mechanism Article 64: Opinion of the Board Article 65: Dispute resolution by the Board Article 66: Urgency procedure Article 67: Exchange of information Article 68: European Data Protection Board Article 69: Independence Article 70: Tasks of the Board Article 71: Reports Article 72: Procedure Article 73: Chair Article 74: Tasks of the Chair Article 75: Secretariat Article 76: Confidentiality Chapter 8: Remedies, liability and penalties Article 77: Right to lodge a complaint with a supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against a controller or processor Article 80: Representation of data subjects Article 81: Suspension of proceedings Article 82: Right to compensation and liability Article 83: General conditions for imposing administrative fines Article 84: Penalties Chapter 9: Specific processing situations Article 85: Processing and freedom of expression and information Article 86: Processing and public access to official documents Article 87: Processing of the national identification number Article 88: Processing in the context of employment Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes Article 90: Obligations of secrecy Article 91: Existing data protection rules of churches and religious associations Chapter 10: Delegated and implementing acts Article 92: Exercise of the delegation Article 93: Committee procedure Chapter 11: Final provisions Article 94: Repeal of Directive 95: /46: /EC Article 95: Relationship with Directive 20: 02: /58: /EC Article 96: Relationship with previously concluded Agreements Article 97: Commission reports Article 98: Review of other Union legal acts on data protection Article 99: Entry into force and application

Legal Text

Article 24 - Responsibility of the controller

1. Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.

2. Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.

3. Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the controller.

Relevant Recitals

Recital 74: Controller Responsibility and Liability

The responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller's behalf should be established. In particular, the controller should be obliged to implement appropriate and effective measures and be able to demonstrate the compliance of processing activities with this Regulation, including the effectiveness of the measures. Those measures should take into account the nature, scope, context and purposes of the processing and the risk to the rights and freedoms of natural persons.

Recital 75: Risks to the Rights and Freedoms of Natural Persons

The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data protected by professional secrecy, unauthorised reversal of pseudonymisation, or any other significant economic or social disadvantage; where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data; where personal data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or criminal convictions and offences or related security measures; where personal aspects are evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, in order to create or use personal profiles; where personal data of vulnerable natural persons, in particular of children, are processed; or where processing involves a large amount of personal data and affects a large number of data subjects.

Recital 76: Evaluating the Risks to Natural Persons

The likelihood and severity of the risk to the rights and freedoms of the data subject should be determined by reference to the nature, scope, context and purposes of the processing. Risk should be evaluated on the basis of an objective assessment, by which it is established whether data processing operations involve a risk or a high risk.

Recital 77: Guidance on Evaluating Risks

Guidance on the implementation of appropriate measures and on the demonstration of compliance by the controller or the processor, especially as regards the identification of the risk related to the processing, their assessment in terms of origin, nature, likelihood and severity, and the identification of best practices to mitigate the risk, could be provided in particular by means of approved codes of conduct, approved certifications, guidelines provided by the Board or indications provided by a data protection officer. The Board may also issue guidelines on processing operations that are considered to be unlikely to result in a high risk to the rights and freedoms of natural persons and indicate what measures may be sufficient in such cases to address such risk.

Recital 78: Appropriate Technical and Organisational Measures

The protection of the rights and freedoms of natural persons with regard to the processing of personal data require that appropriate technical and organisational measures be taken to ensure that the requirements of this Regulation are met. In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default. Such measures could consist, inter alia, of minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing, enabling the controller to create and improve security features. When developing, designing, selecting and using applications, services and products that are based on the processing of personal data or process personal data to fulfil their task, producers of the products, services and applications should be encouraged to take into account the right to data protection when developing and designing such products, services and applications and, with due regard to the state of the art, to make sure that controllers and processors are able to fulfil their data protection obligations. The principles of data protection by design and by default should also be taken into consideration in the context of public tenders.

Commentary

This provision opens Section 1 of Chapter IV, which is dedicated to the “General obligations” of the controller and processor. Article 24 stipulates the abstract obligation of the controller to ensure and demonstrate GDPR compliance and expands the accountability principle set out in Article 5(2) GDPR - together they are the core provisions to implement the "accountability" principle on an abstract level.

Article 24 is therefore closely connected to the more specific obligations of the controller, such as Article 25 GDPR or Article 32 GDPR. This article assigns a proactive role to the controller, who has to ensure compliance with the GDPR at all stages of processing. To achieve this goal, the controller uses technical and organisational measures that are appropriate to the risk connected to the processing. Article 24 is therefor an article that foresees certain flexibility via a "risk based approach".

The controller is not only responsible for actual compliance with the GDPR; it must also be able to demonstrate compliance. The specific way to demonstrate compliance is left to the controller. The Article mentions that the controller can use codes of conduct or approved certification mechanisms as an element of such demonstration.

Given that Article 24 GDPR is an introductory Article between the general obligations in Article 5(2) GDPR and the more specific Articles that follow, it is the only article in the section on the general obligations which cannot be directly penalised with a fine under Article 83(4)(a) or Article 83(5) GDPR.

EDPB and WP29 Guidelines:

• EDPB, 'Guidelines 07/2020 on the concepts of controller and processor in the GDPR', 7 July 2021 (Version 2.1) (available here),
• WP29, 'Opinion 3/2010 on the principle of accountability', 00062/10/EN WP173, 13 July 2010 (available here),
• WP29, 'Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679' 17/EN WP248 rev.01, 4 April 2017 (available here).

(1) Obligation to implement appropriate technical and organisational measures

Addressee of Article 24

This provision obliges the controller to implement appropriate technical and organisational measures to ensure compliance of its processing activities with the GDPR. Therefore, this provision addresses the controller (Article 4(7) GDPR) as the primary addressee for GDPR compliance.

"Article 5(2) and Article 24 of the GDPR impose general accountability and compliance requirements upon the controller of personal data. They require that controller to take appropriate steps to prevent any infringements of the rules laid down in the GDPR in order to ensure the right to the protection of data [...]"

CJEU - C-492/23 - Russmedia, margin number 88.

Other entities, such as data processors, are not subject of Article 24 and their responsibility is limited to specific aspects regulated separately. However, even a limited responsibility of a processor does not affect the overall accountability and liability of the controller.

Furthermore, producers of software and hardware are not subject to Article 24 or indeed the GDPR, if they are not having a role as controller or processor. This means that controllers (often entities with limited know-how in relation to software and hardware) are liable for violations of the GDPR that are triggered by non-compliant software and hardware. The GDPR requires controllers to check their supply chain. This is in reality hard to do, given the extreme market power of some suppliers and the imbalance of know-how. However, provision of products and services that cannot be legally used in the Union may trigger contractual claims against such suppliers.

For example: A small and medium enterprise ("SME") uses a standard software by a dominant software provider. The software unlawfully processes personal data of the SME's employees. Being the controller, the SME is typically liable under the GDPR. However, it may have a civil law claim against the software provider, if the product does not comply with EU law.

Technical and organisational measures to ensure GDPR compliance

Technical and organisational measures

The term "measure" must be understood broadly since it refers to all actions that are appropriate to make the processing compliant with the GDPR. As the provision explains, this can be done through technical and organisational means. "Technical measures" have a direct effect on the operation of technical processing and regularly deal with hard- and software components, while "organisational measures" have an effect on the circumstances of processing and often refer to processes and people connected to the processing activity. In practice, the distinction between technical and organisational measures is not always clear as these can overlap. However, this is unproblematic because the GDPR does not differentiate between the two in terms of legal requirements.

The GDPR does not determine specific measures, given that each processing operation can entail different risks for the rights of freedoms of data subjects. It is upon the controller to identify these risks and take appropriate measures.

For example: A controller wants to enable its employees to work from home. In order to ensure GDPR compliance in relation to the security requirements in Article 32 GDPR, he implements a number of technical and organisational measures, like providing a VPN connection to the company network (technical measure) and drafting a “work from home” policy which makes the use of the VPN connection mandatory and computers are properly protected from third-party access, including through loss of hardware or access by family members (organisational measure).  

Examples of a technical measure that are regularly mentioned are pseudonymisation of personal data, encryption, access restrictions and password protection. The implementation of data protection policies, a yearly review of the processing activities and training of employees and management would be organisational measures.

Many requirements in other Articles of the GDPR (for example the principles in Article 5 GDPR) overlap with duties under Article 24(1) GDPR and require technical and organisational measures independent of Article 24 GDPR.

For example: For example the principle of "data minimisation" or "storage limitation" is usually implemented via a deletion routine (a technical or organisational measure) that limits the risks for the rights and freedoms of data subjects in case of a data breach, because only limited data will be leaked.

Certain other provisions of the GPDR demand the implementation of more specific technical and organisational measures (e.g. Article 25 (1) and (2), Article 28(1), Article 32(1) GDPR, Article 89(1) GDPR). These measures can also be regarded as measures under Article 24(1) since they serve the compliance with the obligations under the GDPR. However, the controller has to assess in these cases if additional measures are necessary given that these Articles apply in parallel with Article 24 GDPR.

Technical and organisational measures to demonstrate GDPR compliance

Pursuant to Article 24(1) the controller must be able to demonstrate the compliance with the GDPR. This provision therefore widens the accountability obligation stipulated in Article 5(2) GDPR which obliges the controller to be able to demonstrate compliance with the data protection principles set out in Article 5(1) GDPR.

The ability to demonstrate compliance with the GDPR must be ensured by the implementation of appropriate technical and organisational measures. The comprehensiveness of the necessary evidence must be proportionate to the risk for the rights of data subjects posed by the processing operation. The riskier or the more complex a processing operation, the more comprehensive the accompanying evidence must be.

The GDPR does not list these measures. The controller can use a wide variety of ways in order to demonstrate that it implemented appropriate technical and organisational measures that ensure compliance with the GDPR. These can be based on policies, electronic records, protocols, statistics or technical implementations that can be later reviewed to demonstrate compliance. The measure has to be appropriate (see below), considering the risk.

For example: It is not sufficient that a controller manages to answer to access requests in accordance with Article 12 GDPR and Article 15 GDPR. A controller that is subject to many subject access requests may also be asked by an authority to demonstrate that it implemented appropriate technical and organisational measures that ensure full compliance with the data subject's right to access.

The GDPR mentions that, a controller can refer to approved codes of conduct or certification mechanisms (see Article 24(3)). Recitals 77 additionally mentions EDPB guidelines and indications provided by the data protection officer. Certain other provisions of the GDPR provide for specific measures to demonstrate compliance (e.g. demonstrating that a data subject has consented under Article 7(1) GDPR, maintaining a record of processing activities under Article 30(1) GDPR, documenting personal data breaches under Article 33(5) GDPR or performing a data protection impact assessment under Article 35 GDPR).

The duty to demonstrate compliance is not limited to demonstrations to the supervisory authority. The duty, for example, also applies to complaint procedures in accordance with Article 77 and 78 GDPR or civil litigation under Article 79 GDPR. Whether the controller’s obligation to demonstrate compliance also implies a reversal of the burden of proof when a data subject seeks compensation for damages pursuant to Article 82 GDPR, is disputed, given the more specific rules in Article 82(3) GDPR.

Measures must be continuously reviewed and updated

Risks and possibilities to combat them are constancy evolving. The controller must continuously ensure and demonstrate compliance with the GDPR by consistently reviewing existing measures and updating them.

Beyond the qualifier "where necessary", it is not specified how frequently updates must be carried out. The criterion of necessity does not mean that the controller must only react to concrete changes. Since it is the controller’s responsibility to ensure that their processing operations are compliant at any time, the controller has to review its measures regularly. However, significant changes in the processing activity or the legal environment will certainly trigger the obligation to review the technical and organisational measures.

For example: A controller running an online-shop receives a complaint from a data subject claiming that one of his online-forms violates the principle of data minimization (Article 5(1)(c) GDPR). Such a complaint could trigger a review of the processing activity.

Equally, the news that a new trend in phishing emails is emerging may require new proactive technical and organisational measures to be implemented to ensure that customers or employees will not fall for such an approach.

In course of the review the controller must assess if the current technical and organisational measures, are still appropriate and effective to ensure the compliance with the GDPR and to enable the controller to demonstrate the compliance. If not, the controller has to implement additional technical and organisational measures or change the existing ones in order to bring the processing activity in compliance with the GDPR.

Typically yearly routines, warnings of security experts, by public authorities or an internal data protection officer in accordance with Article 39(1) GDPR, could be additional triggers to revisit existing measures.

Appropriate measures - the risk based approach

To decide which specific technical and organisational measures to implement, the controller must perform a comprehensive assessment of processing activities and analyse potential consequences and causes of harm in order to effectively evaluate and mitigate risks for the rights and freedoms of natural persons associated with the data processing.

Given that the test is a multi-factor test along the idea of a risk based approach, the controller must apply a very high-level abstract test to a concrete situation. This is not always easy or straight forward.

Common mistake: Many people claim that the GDPR would have a general "risk based approach" throughout the law. This is not correct. In fact you can find different approaches in different Articles of the GDPR:

(1) Most Articles are absolute "yes or no" rules, like the requirements for consent in Article 4(11) GDPR or the fact that upon request access to personal data must be provided under Article 15 GDPR. (2) Some Articles have a "hard coded" risk based approach. For example, any special category data under Article 9 GDPR is considered high risk by law and hence falls under special protections. Anonymised data on the other hand is by definition not regulated by the GDPR. (3) In some Articles, like Article 24, Article 25 or Article 32 GDPR the controller gets to apply a more flexible "risk based approach" based on an open multi-factor test. This allows more flexibility in areas where the legislator cannot realistically codify a rule for each situation. However, this also puts more responsibility on the controller.

Nature, scope, context and purposes of the processing

The controller must consider the nature, scope, context and purposes of the processing.

• The nature of the processing refers in particular to the type or processing (e.g. collection, recording, storing, etc.) as well as to the categories of data processed (e.g. whether special categories of personal data are processed).
• The scope of the processing refers to the quantity of the data processing resulting from the amount of affected data subjects, the amount of processed data, the duration and the geographical extend of the data processing.
• The context of the processing refers to the specific circumstances such as the modalities and technical implementation, the type and method of data collection and the legal basis in accordance with Article 6 GDPR.
• The controller also has to consider the purposes of the processing, for example financial data may be more at risk or data concerning the psychological health of a person may have a larger impact on individuals' rights if leaked. See the commentary on Article 5(1)(b) GDPR for more details on the purpose of a processing activity.

Risks of varying likelihood and severity for rights and freedoms of natural persons

• According to Recital 76 the likelihood and severity of the risk to the rights and freedoms of the data subject should be determined by reference to the nature, scope, context and purposes of the processing. It also states that the risk should be evaluated on the basis of an objective assessment.
• The controller must identify the risks associated with the respective processing activity and assess the severity of those risks for the rights and freedoms of natural persons, as well as the likelihood that these materialise.

• The likelihood is the statistical probability that a certain risk will materialise in the future. It should be noted that some risks are inherent to processing activities – the likelihood is therefore 100 %.

• The severity of the risk is determined by the extent a potential damage would have to the rights and freedoms of a natural person as well as the nature of the damage. Recital 75 clarifies that the damage can be physical, material, or immaterial and lists a range of examples of damages, such as discrimination, identity theft, fraud and loss of confidentiality or control. Recital 83 GDPR similarly suggests that not all risks are equally relevant; rather, the potential physical, material or non-material damage connected to the risk should be considered.

Article 24 does not prescribe procedural steps on how to perform this assessment. Therefore, it is left to the controller to use a suitable method. However, regarding the methodology, reference can be made to the risk assessment in the course of a data protection impact assessment in accordance with Article 35 GDPR, which a controller has to carry out if a processing activity is likely to result in a high risk for the rights and freedoms of natural persons.

Overall appropriateness

The controller has to implement technical and organisational measures that are appropriate for the respective processing activity and effective. Therefore, the controller does not have to implement every available technical and organisational measure but has to consider – taking into account the specific processing activity and the underlying risks – which measures are necessary in order to ensure compliance with the GPDR and enable the controller to demonstrate such compliance. This assessment of proportionality follows from Article 52(1) CFR and has to be conducted by the controller itself.

Relationship with other provisions

It should be noted that the GDPR imposes the duty to implement appropriate technical and organisational measures and to perform a respective risk assessment in a number of its provisions (e.g. in Articles 24, 25, 32 and 35). The legislators have usually used different wording and elements in each of these assessments. While some elements in a specific Article have a logical link to the provision, some other elements seem to be a result of uncoordinated drafting in the legislative process. It depends on each situation if elements can be taking into account when interpreting other Articles or not.

In practice, controllers usually perform a risk assessment for each processing activity taking into account all the requirements set out in the different provisions of the GDPR and implements then appropriate technical and organisational measures that best comply with all those provision.

(2) Data protection policies

Article 24(2) mentions a specific organisational measure, namely the implementation of data protection policies. The term is not defined, but seems to mean internal guidelines with binding effect in the controller’s organisation. Such policies regularly include concrete procedural instructions and oblige the controller’s employees to act in a specific way to ensure compliance with the GDPR. If the controller appointed a data protection officer, this person is also tasked with the monitoring of the controller’s data protection policies (see Article 39(1)(b) GDPR).

For example: Most controllers have a general data protection policy covering topics like the destruction of sensitive documents, the usage of IT-infrastructure and deletion periods as well as more specific data protection policies like specific internal rules regarding the compliance with data protection in the product development process or the handling of access requests in accordance with Article 15 GDPR.

The implementation of data protection policies is only mandatory ("shall"), when it is proportionate to the processing activity. In other words, it is not obligatory to implement a data protection policy for all processing activities. However, for larger organisations or controllers of extensive processing activities the implementation of data protection policies is usually necessary.

Regardless of the existence of an obligation, an implementation of data protection policies is an important tool in order to demonstrate compliance with the GDPR.

(3) Demonstration through codes of conduct and certifications

Article 24(3) provides for the possibility to refer to the adherence to (i) approved codes of conduct (Article 40 GDPR), (ii) approved certification mechanisms (Article 42 GDPR) in order to indicate compliance with the GDPR. Nevertheless, it follows from the word "element" that such self-regulation measures support the assumption that the controller is compliant, but do not prove it. In practice, Article 40 GDPR is not common or even just available in many industry sectors.

For example: A credit information agency adheres to approved codes of conduct when implementing deletion periods for certain data categories could still violate Article 5(1)(a) and Article 6(1) GDPR because the duration of those deletion periods are unjustified.

This provision does not limit the possibility to demonstrate compliance via other means (see section on “And to demonstrate GDPR compliance” above).

Decisions

→ You can find all related decisions in Category:Article 24 GDPR