Accountability under GDPR means a company must be able to demonstrate and document why it keeps personal data for as long as it does - "we've always done it this way" isn't a defence.