# GDPR Certification Scheme Standards Reference

## Primary Legal Provisions

### GDPR Articles 42-43
- **Art. 42(1)**: Encouragement of data protection certification mechanisms, seals, and marks
- **Art. 42(2)**: Certification is voluntary; does not reduce controller/processor responsibility
- **Art. 42(3)**: Certification issued by accredited certification bodies or by supervisory authority
- **Art. 42(5)**: Maximum 3-year validity; renewable; withdrawable for non-compliance
- **Art. 42(7)**: Board shall collate all certification mechanisms in a register
- **Art. 43(1)**: Certification bodies must have appropriate expertise
- **Art. 43(2)**: Two accreditation paths: (a) supervisory authority alone, (b) national accreditation body per ISO 17065 plus SA requirements
- **Art. 43(3)**: Maximum 5-year accreditation, renewable

### EDPB Guidelines
- **Guidelines 1/2018**: Certification and identifying certification criteria (Annex 2 updated)
- **Guidelines 4/2018**: Accreditation of certification bodies under Art. 43
- **Key Principles**: Criteria must relate to processing operations, be precise, be GDPR-rooted, enable meaningful evaluation

## Certification Schemes

### Europrivacy (European Data Protection Seal)
- **Status**: EDPB positive opinion; first European Data Protection Seal
- **Administered by**: European Centre for Certification and Privacy (ECCP), Luxembourg
- **Scope**: Controller and processor processing operations
- **Validity**: 3 years with annual surveillance
- **Standard**: ISO/IEC 17065:2012 for certification body accreditation

### National Schemes
- **AEPD Seal** (Spain): Public administration processing
- **CNIL Scheme** (France): Health data processing (under development)
- **DSK Criteria** (Germany): Sector-specific schemes under consideration

## Related Standards

### ISO/IEC 17065:2012
- **Title**: Conformity assessment — Requirements for bodies certifying products, processes and services
- **Application**: Mandatory for certification bodies accredited under Art. 43(2)(b)

### ISO/IEC 17021-1:2015
- **Title**: Conformity assessment — Requirements for bodies providing audit and certification of management systems
- **Application**: Alternative conformity assessment framework referenced by some national schemes

## Regulatory Benefits

| Article | Benefit |
|---------|---------|
| Art. 24(3) | Demonstrate controller compliance |
| Art. 25(3) | Demonstrate data protection by design compliance |
| Art. 28(5) | Demonstrate processor sufficient guarantees |
| Art. 42(2) | Demonstrate GDPR compliance of processing operations |
| Art. 46(2)(f) | Appropriate safeguard for international transfers |
| Art. 83(2)(j) | Mitigating factor for administrative fines |