Article 5(2) obligation requiring controllers to demonstrate compliance with the data protection principles, not merely comply with them. Requires documented policies, records of processing under Article 30, and evidence producible on regulator demand.