?Accountability is a key principle under the GDPR. However, there is little official guidance as to what it means in practice