Privacy Code Principle: Accountability — what does it require?

• A. It requires data to be encrypted at rest.
• B. It requires the organization to publish annual privacy reports.
• C. It requires quarterly audits.
• D. It requires the organization to designate one or more persons to be accountable for compliance.

Answer: (D)

Accountability means there is a clearly identified person or people within the organization who are responsible for ensuring privacy obligations are met. By designating someone (often a privacy officer or officers) to be accountable for compliance, the organization creates a point of responsibility for implementing privacy policies, training staff, handling requests from individuals, and managing responses to breaches. This governance role is what demonstrates that the organization takes privacy seriously and can be held answerable for its practices.

Encryption at rest is a technical protection, not the governance action described by accountability. Publishing annual privacy reports and quarterly audits can be part of privacy governance, but they do not alone establish who is accountable for compliance. The core accountability requirement is the formal designation of one or more individuals responsible for ensuring the organization follows its privacy obligations.