A data protection authority sends a formal inquiry to a mid-sized company, asking it to demonstrate how its processing of customer personal data complies with applicable privacy law. The company has strong technical controls and a published privacy policy, but its privacy manager struggles to produce evidence of decision-making, data flows, and control effectiveness on demand. Which privacy principle is the company failing to operationalize?