# Security of processing 32(3) — GDPR — provision context

> Focused context for a single provision (32(3)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-32#par-3
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Security of processing** (GDPR, full article: https://overview.legal/laws/gdpr/art-32).

## Provision text

### 32(3)

Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article.


## Topics on this provision

- **Codes of Conduct** — https://overview.legal/topics/codes-of-conduct
  Industry codes of conduct for data protection
- **Accountability** — https://overview.legal/topics/accountability
  Principle of demonstrating GDPR compliance
- **Certification** — https://overview.legal/topics/certification
  Data protection certification mechanisms

## Cited by (exact-provision citations)

- **VB v Natsionalna agentsia za prihodite** (case-law) — https://overview.legal/posts/51485
- **Judgment of the Court (Grand Chamber) of 15 June 2021.#Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit.#Request for a preliminary ruling from the Hof van beroep te Brussel.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 47 – Regulation (EU) 2016/679 – Cross-border processing of personal data – ‘One-stop shop’ mechanism – Sincere and effecti** (case-law) — https://overview.legal/posts/132323
- **VB v Natsionalna agentsia za prihodite** ¶34 (case-law, CJEU) — https://overview.legal/posts/51485
- **Judgment of the Court (Grand Chamber) of 15 June 2021.#Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit.#Request for a preliminary ruling from the Hof van beroep te Brussel.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 47 – Regulation (EU) 2016/679 – Cross-border processing of personal data – ‘One-stop shop’ mechanism – Sincere and effecti** ¶27 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132323
- **Judgment of the Court (Grand Chamber) of 15 June 2021.#Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit.#Request for a preliminary ruling from the Hof van beroep te Brussel.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 47 – Regulation (EU) 2016/679 – Cross-border processing of personal data – ‘One-stop shop’ mechanism – Sincere and effecti** ¶23 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132323
- **Judgment of the Court (Grand Chamber) of 15 June 2021.#Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit.#Request for a preliminary ruling from the Hof van beroep te Brussel.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 47 – Regulation (EU) 2016/679 – Cross-border processing of personal data – ‘One-stop shop’ mechanism – Sincere and effecti** ¶35 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132323
- **VB v Natsionalna agentsia za prihodite** ¶28 (case-law, CJEU) — https://overview.legal/posts/51485
- **Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679** (guidance) — https://overview.legal/posts/38051

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-32#par-3 · 2026-08-22