The principle of accountability requires the controller to demonstrate its compliance with the requirements of the GDPR, establishing a general reversal of the burden of proof. This conclusion is especially true in controller-supervisory authority relationships and, to a lesser extent, in controller-data subject interactions. There are, in fact, situations in which the data subject cannot claim prerogatives granted to him or her by law, without substantiating his or her claims in any way.
In this circumstance, we will reread the provisions on the exercise of rights under this particular interpretation.
Accountability and burden of proof
The data controller bears the burden of proof on all disputes where the subject of the issue is compliance with the principles of data processing under Article 5(1) of the GDPR. Indeed, “in accordance with the principle of accountability set out in Article 5(2) of Regulation 2016/679, the data controller must be able to prove that it has complied with the principles applicable to the processing of personal data set out in paragraph 1 of that article” (CJEU, SS SIA v. Valsts, C-175/20, p. 77).
