Rechenschaftspflicht

A notebook is decommissioned, the hard drive is erased, the device is sold. Months later the supervisory authority or an auditor asks: how did you ensure that the data on it is no longer readable? Anyone who can only say "it was taken care of" has a problem. This glossary entry explains accountability under the GDPR and shows which records belong to IT decommissioning.

What does Art. 5 para. 2 GDPR say?

Art. 5 para. 1 GDPR lists the principles for every processing of personal data, for example purpose limitation, data minimization, storage limitation as well as integrity and confidentiality. Art. 5 para. 2 adds a short but consequential sentence: the controller is responsible for compliance with these principles and must be able to demonstrate it. In the English text this is called "accountability".

The controller is whoever decides on the purposes and means of the processing, usually the company itself. Art. 24 GDPR specifies the obligation: the controller implements appropriate technical and organizational measures to ensure that processing complies with the GDPR, and must be able to demonstrate this. The measures are to be reviewed and updated where necessary.

Accountability is not a separate provision with a fixed checklist. It acts like a bracket around all other obligations. Further articles make it tangible, such as the record of processing activities (Art. 30), the security of processing (Art. 32) and the documentation of data breaches (Art. 33 para. 5).

What does accountability mean for decommissioned IT?

A device on which personal data resides remains part of the processing until verifiable erasure. This applies to notebooks, PCs, servers and smartphones as well as to printers with a hard drive or removed storage media. The principles of storage limitation and confidentiality therefore do not end on a device's last working day.

Three practical questions follow from this, which you should be able to answer for every decommissioned device:

• Which device was it? Clearly identified, ideally via the serial number.
• Where was it until erasure? Documented without gaps from the workstation to the service provider. This documented sequence is called Chain of custody.
• What happened to the data? Erased or destroyed, with which method, when and with what result.

If you engage a service provider, you remain accountable as the controller. The service provider is generally a processor, with whom you conclude a data processing agreement . Its reports and certificates are then your records.

Obligations and records at a glance

The following table maps typical records to the GDPR obligations affected by IT decommissioning.

Obligation	Legal basis	Typical record for decommissioning
Comply with and demonstrate the principles	Art. 5 para. 2, Art. 24 GDPR	Erasure policy, process description for decommissioning
Security of processing	Art. 32 GDPR	Technical and organizational measures (TOM) of the service provider, sealed transport
Select processors carefully	Art. 28 GDPR	Data processing agreement, certificates, audit reports
Storage limitation and erasure	Art. 5 para. 1 point (e), Art. 17 GDPR	Erasure certificate or certificate of destruction per serial number
Document data breaches	Art. 33 para. 5 GDPR	Discrepancy report if a device is missing, and its assessment

The connection matters: the individual records must fit together via a common identifier. An Erasure certificate without a serial number cannot later be assigned to any device in your inventory.

Typical mistakes

• Collective records without serial numbers: A certificate for "3 pallets of IT scrap" or a weight in kilograms does not prove the erasure of individual data carriers.
• Factory reset as erasure: A reset without a report is not proof. Whether it is technically sufficient depends on the device.
• Undocumented handovers: Boxes are collected without anyone signing a device list.
• Records that get lost: Certificates sit in a mailbox that nobody can find after a staff change.
• No review of the service provider: There is neither a contract nor insight into its measures. Hints for the selection are provided by our guide Choosing an ITAD provider.

Violations of the principles under Art. 5 GDPR are among the cases for which Art. 83 para. 5 GDPR provides the higher fine range: up to 20 million euros or up to 4% of worldwide annual turnover, whichever amount is higher. This entry does not replace legal advice. For your individual case, speak with your data protection officer.

Practical example: 40 notebooks from accounting

A simplified example shows what accountability looks like in everyday practice. A company replaces 40 notebooks from accounting. The devices hold payroll data and customer data.

1. IT creates a device list with serial number, model and inventory number and presents it to the service provider.
2. At collection, the devices are sealed. A handover record states the quantity and seal numbers and is signed.
3. At goods receipt, the service provider matches the serial numbers against the list. All 40 devices are complete.
4. Every device is erased. For each serial number, an erasure certificate is produced stating the method, date and result.
5. IT files the device list, handover record and certificates together and notes the process in the erasure policy.

If an auditor later asks, each of the 40 devices can be documented within minutes. What information such a record should contain is described in our guide Certificate of destruction and erasure report. How the entire process can be made GDPR-compliant, you can read in Disposing of data carriers in GDPR-compliant fashion.

Accountability at Second IT

Second IT provides the records you need for your accountability obligation. The hardware is collected with our own secure logistics: direct trips without intermediate storage, GPS monitoring, tamper-proof sealing and insured transport. At goods receipt, all devices are checked for storage media and registered by serial number. Processing takes place in areas with access control and video surveillance, and employees are bound to data secrecy.

Erasure is performed with Blancco, including in hidden areas such as HPA and DCO. Every device receives a digitally signed erasure certificate. Data carriers that cannot be erased are destroyed in-house in accordance with DIN 66399 at security level H-5 and documented with a certificate of destruction. Audit reports and live tracking are available in the customer portal. More on the protective measures can be found under Data security at Second IT.

Distinction from related terms

Accountability is the overarching principle. The technical and organizational measures (TOM) are the concrete safeguards with which you fulfill it. An Data protection audit checks whether measures and records are sufficient. The Erasure report and the erasure certificate are individual records within this system.

Frequently asked questions about accountability

What does accountability mean in the GDPR?

It obliges companies to be able to demonstrate compliance with the data protection principles (Art. 5 para. 2 GDPR). It is therefore not enough to process and erase data correctly. You must be able to prove, on request, that and how you did so.

Is there a template for which documents I need?

The GDPR does not name a fixed list. Common are a record of processing activities, an erasure policy, descriptions of the technical and organizational measures, contracts with processors and, for decommissioning, erasure or destruction records per serial number.

Am I also responsible if a service provider erases?

Yes. The service provider works as a processor on your behalf. You must select it carefully, conclude a contract under Art. 28 GDPR and retain the records it provides you.

How long should I keep erasure records?

The GDPR does not specify a fixed period for erasure records. Keep them for as long as you must expect inquiries from authorities, auditors or data subjects. Set the period in your erasure policy and coordinate it with your data protection advisor.

Accountability or TOM: What is the difference?

Accountability is the overarching principle. The technical and organizational measures (TOM) are the concrete safeguards with which you fulfill it. A data protection audit checks whether measures and records are sufficient. Erasure report and erasure certificate are individual records.