Who is primarily responsible for ensuring GDPR compliance in an organization?

The correct answer is that data controllers are primarily responsible for ensuring GDPR compliance in an organization. Data controllers are entities or individuals who determine the purposes and means of processing personal data. They play a key role in managing how personal data is handled, ensuring that all processing activities comply with the requirements set forth by the GDPR. This includes establishing clear policies, obtaining necessary consents from data subjects, and ensuring that data protection measures are in place and effective.

While data processors also have responsibilities under GDPR — notably to manage data in accordance with the controller's instructions — the ultimate responsibility for compliance lies with the data controllers. They are tasked with the oversight and accountability for the lifecycle of personal data and must implement appropriate security measures, maintain records of processing activities, and report breaches when they occur.

Data subjects, on the other hand, are the individuals whose personal data is being processed and thus have rights under GDPR rather than responsibilities. IT security teams support compliance efforts by implementing technical safeguards and measures, but they do not hold the primary accountability for compliance with GDPR regulations.