The ICO’s new accountability framework
The ICO’s accountability framework – What’s new?
On 7th October 2024, the day before its annual conference, the ICO launched its new audit framework. The new version is a development of the former Accountability Framework, which was originally published in 2020, and enables a more in-depth analysis by adding eight additional areas with toolkits and trackers for each one.
Background
The toolkits were initially developed by the ICO for internal use by the ICO but were ‘tweaked’ so that they could be used by a wider audience, as it became clear that organisations striving to improve their data protection posture would benefit from the same.
Who should use it?
The ICO has confirmed that the toolkits are designed primarily for larger organisations and suggests that their web hub Find the right resource | ICO and self-assessment toolkit Data protection self-assessment | ICO are more suitable for small businesses.
What is in the audit framework toolkits?
The toolkits contain numerous “control measures” i.e. steps that can be taken to mitigate or manage an identified risk, together with a list of ways in which organisations can meet the ICO’s expectations. In other words, the toolkits explain each of the data protection risks the ICO has identified, what the ICO considers needs to be done to address those risks and examples of what this would look like in practice.
The key topics now covered in the toolkits include:
- Accountability
- Records Management
- Information and Cyber Security
- Training and Awareness
- Data Sharing
- Requests for Data
- Personal Data Breach Management
- Artificial Intelligence
- Age-Appropriate Design
The first toolkit in the list above is the Accountability Toolkit, which covers 10 different areas including:
- Leadership and Oversight
- Policies and Procedures
- Training and Awareness
- Information Rights
- Transparency
- ROPA and lawful basis
- Contracts and Data Sharing
- Risks and DPIAs
- Records Management and Security
- Breach Response and Monitoring
This particular toolkit is designed to provide a starting point for an organisation’s data protection audit as, once completed, it will provide a broad overview of the organisation’s overall level of compliance, at that time. From there, other topics can be chosen and the corresponding toolkit used, in order to “drill down” into the processing activities in more detail and address outstanding issues.
How to use the toolkits
For each toolkit, there is a corresponding “tracker”. The tracker is an Excel spreadsheet that contains individual tabs for each of the topics within the particular area being audited. Each tab is designed to record the organisation’s current status for each control measure, the reasons for that status, details of the action to be taken (if needed), who is responsible for that action and the date by which the action needs to be taken.
The tracker is designed to be a living document which is to be regularly maintained and updated by the organisation as it progresses through the audit and the remediation actions. In terms of the organisation’s current status, the organisation is required to choose one of the following categories (in relation to the ICO’s expectations):
- Fully meets
- Partially meeting
- Not meeting expectation
- Not applicable
If the status is not recorded as “Fully meets”, the organisation would need to identify and insert the remedial action, the owner of the action and a date by which this needs to be completed. Following this, they would need to revisit the tracker on a regular basis to record progress and update the status, as necessary.
The tracker also contains a “Master Sheet” and a “Dashboard” and, as the organisation completes each of the individual tabs, the information feeds through to the Master Sheet and the Dashboard. The Master Sheet shows all the information from each of the tabs on one page and the Dashboard provides a visual representation of how the organisation is progressing. The latter is useful visualisation for an “at a glance” view of the organisation’s status and is likely to be useful for reporting.
Improvements
The ICO has confirmed that it welcomes feedback from organisations using the toolkits and that it will look at ways to continually improve this resource.
Need a data protection gap analysis?
If you need expert assistance with your internal data protection audit, we would be glad to help.
View our Data Protection Package options here
