# Certification 42(7) — GDPR — provision context

> Focused context for a single provision (42(7)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-42#par-7
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Certification** (GDPR, full article: https://overview.legal/laws/gdpr/art-42).

## Provision text

### 42(7)

Certification shall be issued to a controller or processor for a maximum period of three years and may be renewed, under the same conditions, provided that the relevant requirements continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the requirements for the certification are not or are no longer met.


## Topics on this provision

- **Processors** — https://overview.legal/topics/processors
  Entities that process data on behalf of controllers
- **Certification** — https://overview.legal/topics/certification
  Data protection certification mechanisms
- **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities
  National data protection authorities and their powers
- **Supervision** — https://overview.legal/topics/toezicht
  Oversight and enforcement by supervisory authorities
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation** (guidance) — https://overview.legal/posts/38048
- **Opinion 25/2021 on the draft decision of the competent supervisory authority of Lithuania regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR)** (guidance) — https://overview.legal/posts/126002
- **Contribution of the EDPB to the evaluation of the GDPR under Article 97** (guidance) — https://overview.legal/posts/126182
- **Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of the General Data Protection Regulation (2016/679)** (guidance) — https://overview.legal/posts/126260
- **Opinion 12/2023 on the draft decision of the competent supervisory authority of Cyprus regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR)** (guidance) — https://overview.legal/posts/125843
- **Opinion 11/2022 on the draft decision of the competent supervisory authority of Poland regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR)** (guidance) — https://overview.legal/posts/125931
- **Opinion 25/2021 on the draft decision of the competent supervisory authority of Lithuania regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR)** §20 (guidance, EDPB) — https://overview.legal/posts/126002
- **Opinion 12/2023 on the draft decision of the competent supervisory authority of Cyprus regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR)** §24 (guidance, EDPB) — https://overview.legal/posts/125843
- **Opinion 11/2022 on the draft decision of the competent supervisory authority of Poland regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR)** §31 (guidance, EDPB) — https://overview.legal/posts/125931

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-42#par-7 · 2026-08-22