Certification under Article 42 GDPR
Accredited data protection certificates
TL;DR
Under Art. 42 GDPR, accredited certification bodies or the competent supervisory authority issue certifications intended to demonstrate compliance with the GDPR in processing operations. They are voluntary and may be used as an element in demonstrating compliance under Art. 24(3) and Art. 28(5).
What is certification under Article 42 GDPR?
How certification under the GDPR works:
- European Data Protection Seal — a common certification where the European Data Protection Board approves the criteria (Art. 42(5) GDPR)
- National certification mechanisms — criteria approved by the competent supervisory authority (Art. 42(5), Art. 58(3) GDPR)
- Issued by accredited certification bodies (Art. 43 GDPR) or by the competent supervisory authority
- Public register of all certification mechanisms and data protection seals kept by the European Data Protection Board (Art. 42(8) GDPR) — use it to check whether a scheme is approved
Legal position: Germany and Austria
Certification itself is, as an EU regulation, identical in substance in both countries (Art. 42 GDPR). What differs is who accredits the certification bodies (Art. 43 GDPR) and which supervisory authority is competent.
Germany
Certification bodies are accredited by the German national accreditation body (Deutsche Akkreditierungsstelle, DAkkS); on that basis, the competent federal or Länder data protection supervisory authority grants the authorisation to act as a certification body (§ 39 BDSG). Supervision is exercised by the Länder data protection authorities over non-public bodies (§ 40 BDSG) and by the Federal Commissioner for Data Protection (BfDI) over federal public bodies (§ 9 BDSG).
Austria
Accreditation is carried out by the Austrian Data Protection Authority (Datenschutzbehörde) itself: it acts as the sole national accreditation body under Art. 43(1)(a) GDPR and publishes the accreditation criteria by regulation (§ 21(3) DSG). In Austria, the Data Protection Authority is the only competent supervisory authority under Art. 51 GDPR (§ 18(1) DSG). DAkkS and the BfDI have no competence in Austria.
Example from practice
SaaS provider X advertises itself as 'GDPR-certified'. Before signing, a customer checks: under which approved mechanism was it certified (register of the European Data Protection Board, Art. 42(8) GDPR)? Which processing operations does the certificate cover, and is it still valid? A suitable certification may be used as an element in demonstrating sufficient guarantees on the part of the processor (Art. 28(5) GDPR).