The principle that an organisation is not only responsible for complying with GDPR but must also be able to demonstrate that compliance with records and evidence (Article 5(2)).