# GDPR Certification Scheme Workflows

## Workflow 1: Certification Pursuit

1. **Scheme Selection**: Identify applicable GDPR certification scheme (Europrivacy or national)
2. **Scope Definition**: Define processing operations to be certified
3. **Certification Body Selection**: Select accredited certification body
4. **Gap Assessment**: Assess current compliance against certification criteria
5. **Remediation**: Address identified gaps
6. **Self-Assessment**: Complete scheme's self-assessment questionnaire
7. **Documentation Review**: Certification body reviews documentation
8. **On-Site Audit**: Certification body conducts on-site assessment
9. **Finding Resolution**: Address any nonconformities
10. **Certification Decision**: Certification body issues decision
11. **Seal Usage**: Display certification seal per usage rules
12. **Annual Surveillance**: Submit to annual surveillance assessments
13. **Renewal**: Full reassessment before 3-year expiry

## Workflow 2: Europrivacy Certification Process

### Phase 1: Application (4-6 weeks)
1. Select Europrivacy-accredited certification body
2. Define scope of processing operations
3. Complete scoping exercise with certification body
4. Sign certification agreement

### Phase 2: Self-Assessment (6-8 weeks)
5. Complete Europrivacy self-assessment questionnaire
6. Map controls to applicable criteria
7. Compile evidence portfolio
8. Submit to certification body

### Phase 3: Documentation Review (4-6 weeks)
9. Certification body reviews self-assessment
10. Address documentation gaps
11. Provide additional evidence as requested

### Phase 4: On-Site Audit (1-2 weeks)
12. Certification body conducts on-site audit
13. Interviews, document verification, technical testing
14. Receive audit findings

### Phase 5: Decision (2-4 weeks)
15. Certification body evaluates findings
16. Decision: Certified / Certified with conditions / Not certified
17. If certified: receive certificate and seal
18. Entry in public register

## Workflow 3: Annual Surveillance

1. **Preparation** (Month 10-11): Update self-assessment, refresh evidence
2. **Material Change Reporting**: Report any changes to certification body
3. **Surveillance Assessment**: Lighter-touch assessment by certification body
4. **Finding Resolution**: Address any surveillance findings
5. **Continued Certification**: Certification body confirms continued compliance

## Workflow 4: Seal Usage Management

1. **Obtain Seal Assets**: Receive official seal files from certification body
2. **Usage Review**: Review seal usage rules and restrictions
3. **Implementation**: Display seal on website, privacy notice, and marketing
4. **Compliance Monitoring**: Ensure seal display includes required information
5. **Expiry Management**: Remove seal promptly upon expiry or withdrawal