What it asks for. The article sets out the core principles for all processing: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality, which requires appropriate security. It also sets out accountability, meaning the controller is responsible for compliance and must be able to demonstrate it.
In practice. Doing this well means each processing activity has a defined purpose, a lawful basis, a retention period and appropriate security, and that these are written down. Evidence includes records of processing, retention schedules that are actually enforced, data minimisation decisions in system design and security controls matched to the sensitivity of the data. Accountability is shown through policies, training, assessments and audit trails.
Common gaps. Retention periods are commonly defined on paper but not applied in systems, so old data accumulates. Many organisations also struggle to demonstrate compliance, even where practice is reasonable.