Article 42
Certification
Chapter 4
|
Controller and Processor
|
📖 4 min read
1. The Member States, the supervisory authorities, the Board and the Commission shall encourage, in particular at Union level, the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance with this Regulation of processing operations by controllers and processors. The specific needs of micro, small and medium-sized enterprises shall be taken into account.
2. In addition to adherence by controllers or processors subject to this Regulation, data protection certification mechanisms, seals or marks approved pursuant to paragraph 5 of this Article may be established for the purpose of demonstrating the existence of appropriate safeguards provided by controllers or processors that are not subject to this Regulation pursuant to Article 3 within the framework of personal data transfers to third countries or international organisations under the terms referred to in point (f) of Article 46(2). Such controllers or processors shall make binding and enforceable commitments, via contractual or other legally binding instruments, to apply those appropriate safeguards, including with regard to the rights of data subjects.
3. The certification shall be voluntary and available via a process that is transparent.
4. A certification pursuant to this Article does not reduce the responsibility of the controller or the processor for compliance with this Regulation and is without prejudice to the tasks and powers of the supervisory authorities which are competent pursuant to Article 55 or 56.
5. A certification pursuant to this Article shall be issued by the certification bodies referred to in Article 43 or by the competent supervisory authority, on the basis of criteria approved by that competent supervisory authority pursuant to Article 58(3) or by the Board pursuant to Article 63. Where the criteria are approved by the Board, this may result in a common certification, the European Data Protection Seal.
6. The controller or processor which submits its processing to the certification mechanism shall provide the certification body referred to in Article 43, or where applicable, the competent supervisory authority, with all information and access to its processing activities which are necessary to conduct the certification procedure.
7. Certification shall be issued for a maximum period of three years and may be renewed, under the same conditions, provided that the relevant requirements continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the requirements for the certification are not or are no longer met.
8. The Board shall collate all certification mechanisms and data protection seals and marks in a register and make them publicly available by any appropriate means.
Understanding This Article
Article 42 establishes a voluntary certification framework that allows organizations to demonstrate their GDPR compliance through recognized seals and marks. This is particularly valuable for building trust with customers and business partners, and provides a competitive advantage in demonstrating data protection commitment.
The article recognizes that certification can serve multiple purposes. Domestically, it helps organizations show they meet GDPR standards. Internationally, certification can facilitate data transfers to third countries by demonstrating appropriate safeguards under Article 46(2)(f). Organizations outside the EU can also obtain certification to demonstrate their data protection standards to EU partners.
Importantly, certification is voluntary and transparent, but it does not reduce legal obligations or limit supervisory authority oversight. Organizations cannot hide behind certification if they violate GDPR—it's a demonstration of compliance, not a shield from responsibility. Certification lasts a maximum of three years, ensuring regular reassessment, and can be withdrawn if standards are no longer met.
The Board-approved criteria can lead to a "European Data Protection Seal," creating a consistent, recognizable mark across the EU that consumers and businesses can trust.
Practical Application
Example 1 - Cloud Service Provider: A cloud hosting company seeks GDPR certification to attract EU customers. It applies to an accredited certification body, provides full access to its processing activities, security measures, and data protection policies. After thorough assessment against approved criteria, it receives certification valid for three years. The company displays the certification seal on its website, marketing materials, and customer contracts, helping win business from privacy-conscious EU organizations.
Example 2 - International Data Transfer: A US-based CRM software company wants to process EU customer data. It obtains GDPR certification from an EU-recognized certification body, making binding commitments to apply appropriate safeguards and respect data subject rights. EU companies can then transfer personal data to this provider under Article 46(2)(f), using the certification as evidence of appropriate safeguards in their data transfer agreements.
Example 3 - SME Benefit: A small e-commerce startup with limited resources wants to demonstrate GDPR compliance to customers but cannot afford expensive legal audits. It uses a streamlined certification process designed for SMEs, working with a certification body that offers affordable rates and simplified documentation requirements. Upon certification, the startup displays the European Data Protection Seal, building customer confidence and competing with larger retailers.
Example 4 - Certification Withdrawal: A certified data processor experiences multiple data breaches due to inadequate security measures. The certification body conducts a review, finds the processor no longer meets security criteria, and withdraws the certification. The processor must remove all certification marks and inform its clients of the withdrawal.