The accountability review: what evidence should the board see?

The source and its limits

The ICO's Data protection audit framework extends its earlier Accountability Framework, now presented through an Accountability toolkit and other audit toolkits. It is a resource for larger organisations; the ICO directs smaller businesses to its small-business support. It is not exhaustive and following it does not guarantee legal compliance.

The toolkit covers leadership, policies, training, individual rights, transparency, processing records, contracts, DPIAs, security and breach response. Its pages carry an update notice concerning the Data (Use and Access) Act. Check current linked guidance when making a decision.

A suggested review for management

Pick one material processing activity and trace it from purpose to control. Ask for evidence supporting the lawful basis, what people are told, which suppliers handle the information and how a rights request would be recognised. Where a DPIA is needed, check whether its safeguards were actually implemented.

Then review a recent exception: a delayed request, supplier weakness or incident. What decision was made, who accepted the residual risk and what remains unresolved? A concise report of the exception and remedial work can be more useful than an unqualified green score.

• Show the scope and period of the review.
• Distinguish an absent control from a control with untested operation.
• Assign each material action an owner and a measurable completion criterion.
• Record uncertainty and further advice required.
• Schedule follow-up and retain evidence of the retest.

The practical takeaway

A board pack should help management decide what needs attention and resources. Use brief examples and restricted evidence references, avoiding unnecessary personal data. This is a suggested reporting method informed by official resources, not an ICO-approved assessment or a certification scheme.