# Standards and Regulatory References

## Primary Legislation

### GDPR Article 42 -- Certification
- **Art. 42(1)**: Encouragement of certification mechanisms to demonstrate compliance.
- **Art. 42(3)**: Certification is voluntary and available via transparent process.
- **Art. 42(5)**: Issued by accredited certification bodies or supervisory authority on approved criteria.
- **Art. 42(7)**: Maximum 3-year validity, renewable; withdrawn when requirements not met.

### GDPR Article 43 -- Certification Bodies
- **Art. 43(1)**: Bodies must demonstrate independence, expertise, and freedom from conflicts of interest.
- **Art. 43(3)**: Accreditation by supervisory authority or national accreditation body per Regulation (EC) No 765/2008.
- **Art. 43(6)**: Accreditation maximum 5 years, renewable.

### GDPR Article 24(3) -- Certification as Accountability Element
Adherence to approved certification mechanisms may be used as an element to demonstrate compliance with controller obligations.

### GDPR Article 28(5) -- Processor Certification
Processor adherence to an approved certification mechanism may be used as an element to demonstrate sufficient guarantees.

## Regulatory Guidance

### EDPB Guidelines 1/2018 on Certification (Version 3.0, 4 June 2019)
Provides detailed guidance on:
- Requirements for certification criteria
- Accreditation requirements for certification bodies
- The role of supervisory authorities and the EDPB in approving criteria
- Relationship between certification and other accountability tools

### EDPB Opinion 28/2022 on Europrivacy Criteria
First GDPR certification criteria approved by the EDPB under Art. 42(5), establishing the benchmark for future certification schemes.

### ISO/IEC 17065:2012
Requirements for bodies certifying products, processes, and services -- the standard used as basis for accrediting GDPR certification bodies under Art. 43(1)(b).

## ISO/IEC Standards

- **ISO/IEC 27701:2019**: PIMS extension to ISO 27001/27002, covering privacy management controls aligned to GDPR.
- **ISO/IEC 27001:2022**: ISMS certification providing the security foundation for GDPR compliance.
- **ISO/IEC 17021-1:2015**: Requirements for audit and certification bodies, used as supplementary standard for GDPR certification body accreditation.