# Data Protection Certification Workflow Reference

## Certification Scheme Selection Workflow

1. Identify the business objective: demonstrating GDPR compliance to customers, meeting contractual requirements, or strengthening accountability posture.
2. Evaluate available schemes against scope: Europrivacy for full GDPR, ISO 27701 for privacy management system, EuroPriSe for products/services.
3. Assess cost-benefit: certification body fees, internal effort, maintenance costs vs commercial and compliance benefits.
4. Confirm the scheme is approved by the relevant supervisory authority or the EDPB.
5. Select the scheme and notify stakeholders.

## Gap Assessment Workflow

1. Obtain the certification criteria document from the certification body or supervisory authority.
2. Map each criterion to the current state of the organisation's controls, policies, and documentation.
3. Classify each criterion as: Met, Partially Met, or Not Met.
4. Produce a gap report with prioritised remediation actions.
5. Estimate effort and timeline for remediation.
6. Obtain management approval for the remediation plan and budget.

## Certification Audit Preparation Workflow

1. Complete all remediation actions identified in the gap assessment.
2. Conduct an internal pre-assessment audit using the certification criteria as the checklist.
3. Address any findings from the pre-assessment.
4. Prepare the evidence portfolio: policies, procedures, RoPA, DPIAs, training records, audit reports.
5. Brief staff who may be interviewed during the certification audit.
6. Schedule the certification audit with the accredited certification body.

## Post-Certification Maintenance Workflow

1. Implement continuous monitoring controls aligned with certification requirements.
2. Track and report any material changes in processing operations to the certification body.
3. Conduct annual internal reviews against certification criteria.
4. Participate in surveillance audits as scheduled by the certification body.
5. Begin re-certification preparation 6 months before the 3-year expiry.
6. Maintain the certification mark usage in accordance with the certification body's brand guidelines.