# Regulatory Standards — Vendor Certification Acceptance

## Primary Regulations

### GDPR — Regulation (EU) 2016/679

- **Article 42(1)**: "The Member States, the supervisory authorities, the Board and the Commission shall encourage, in particular at Union level, the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance with this Regulation of processing operations by controllers and processors."

- **Article 42(2)**: Certification shall be voluntary and available via a transparent process. It does not reduce controller or processor responsibility for GDPR compliance and is without prejudice to the tasks and powers of supervisory authorities.

- **Article 28(5)**: "Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees." Note: "an element" — not the sole basis.

- **Article 43**: Certification bodies must be accredited by the national accreditation body and/or the supervisory authority. They must demonstrate independence, expertise, and absence of conflicts of interest.

- **Article 40**: Codes of conduct may be drawn up by associations and other bodies representing categories of controllers or processors. Must be approved by the competent supervisory authority per Article 40(5).

### EDPB Guidelines 07/2020 on Controller and Processor Concepts

- **Paragraph 86**: "In assessing whether a processor provides sufficient guarantees, the controller should take into account... Adherence to an approved code of conduct pursuant to Article 40 or an approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate sufficient guarantees."

- **Paragraph 87**: Certifications "do not discharge the controller's own obligation to assess whether the processor provides sufficient guarantees. They may, however, significantly reduce the controller's assessment burden."

### EDPB Guidelines 1/2018 on Certification

- **Paragraph 16**: Certification criteria must be relevant to the nature, scope, context, and purposes of processing, as well as the risks for data subjects.
- **Paragraph 20**: Certification must be based on an assessment by an accredited certification body and must cover the processing activities in question.
- **Paragraph 28**: Certification is valid for a maximum of 3 years and must be renewed through re-examination.

## Certification Framework Standards

### ISO/IEC 27701:2019

Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management:
- Annex A: PII controller additional controls (maps to GDPR controller obligations)
- Annex B: PII processor additional controls (maps to GDPR processor obligations)
- Annex D: Mapping to GDPR provisions (informative)
- Annex F: Mapping to ISO/IEC 29100 (informative)

### SOC 2 Trust Services Criteria

The AICPA Trust Services Criteria provide evaluation framework:
- **Common Criteria (CC)**: Security — mandatory for all SOC 2 reports
- **Additional Criteria**: Availability (A), Processing Integrity (PI), Confidentiality (C), Privacy (P)
- **Privacy Criteria (P1-P9)**: Notice, choice/consent, collection, use/retention/disposal, access, disclosure, security for privacy, quality, monitoring/enforcement

### APEC Cross-Border Privacy Rules (CBPR)

- Voluntary accountability-based system for cross-border data transfers among APEC economies
- Nine APEC Privacy Principles: preventing harm, notice, collection limitation, uses of information, choice, integrity, security safeguards, access/correction, accountability
- Administered through Accountability Agents
- Recognized members (as of 2026): US, Japan, South Korea, Canada, Singapore, Taiwan, Philippines, Australia, Mexico

### EU Cloud Code of Conduct (SCOPE Europe)

- Approved as GDPR Article 40 Code of Conduct by Belgian DPA (May 2021)
- SCOPE Europe designated as monitoring body per Article 41
- Covers cloud service providers acting as processors
- Maps to GDPR Articles 28, 32, 33, and Chapter V

## Supervisory Authority Guidance

### CNIL — Certifications and Codes of Conduct Guidance

CNIL recognizes certifications as useful but non-dispositive:
- Controllers cannot rely solely on vendor certifications
- Certification scope must be verified against actual processing
- Expired or out-of-scope certifications have no evidential value
- Controllers should maintain their own assessment alongside certification review

### Irish DPC — Processor Assessment and Certifications

The DPC acknowledges that ISO 27001 and SOC 2 reports can support sufficiency assessments but emphasizes:
- They address security (Article 32) but not all Article 28(3) obligations
- Controllers must assess privacy-specific obligations separately
- Certification bodies and audit quality vary — controllers should evaluate report quality