Opinion 16/2025 regarding the draft decision of the German North Rhine Westphalia Supervisory Authority regarding Trusted Site Data Privacy (TÜV IT) certification criteria

Adopted 1 Opinion 16 /2025 regarding the draft decision of the German North Rhine Westphalia Supervisory Authority regarding Trusted Site Data Privacy (TÜV IT) certification criteria Adopted on 8 July 2025 Adopted 2 Adopted 3 The European Data Protection Board Having regard to Article 63, Article 64(1)(c) and Article 42 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”), Having regard to the European Economic Area (hereinafter “EEA”) Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 1 , Having regard to Article 64(1)(c) of the GDPR and Articles 10 and 22 of its Rules of Procedure. Whereas: (1) Member States, s upervisory a uthorities, the European Data Protection Board (hereinafter “the EDPB”) and the European Commission shall encourage, in particular at Union level, the establishment of data protection certification mechanisms (hereinafter “certification mechanisms”) and of data protection seals and marks, for the purpose of demonstrating compliance with the GDPR of processing operations by controllers and processors, taking into account the specific needs of micro, small and medium - sized enterprises 2 . In addition, the establishment of certifications can enhance transparency and allow data subjects to assess the level of data protection of relevant products and services 3 . (2) The certification criteria form an integral part of any certification mechanism. Consequently, the GDPR requires the approval of national certification criteria of a certification mechanism by the competent supervisory authority (Articles 42(5) and 43(2)(b) of the GDPR), or in the case of a European Data Protection Seal, by the EDPB (A rticles 42(5) and 70(1)(o) of the GDPR). (3) When a supervisory authority (hereinafter “SA”) intends to approve a certification pursuant to Article 42(5) of the GDPR, the main role of the EDPB is to ensure the consistent application of the GDPR, through the c onsistency mechanism referred to in Articles 63, 64 and 65 of the GDPR. In this framework, according to Article 64(1)(c) of the GDPR, the EDPB is required to issue an Opinion on the SA’s draft decision approving the certification criteria. (4) This Opinion aims to ensure the consistent application of the GDPR, including by the SAs, controllers and processors in the light of the core elements which certification mechanisms have to develop. In particular, the EDPB assessment is carried out on the basis “Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation” (hereinafter the “Guidelines”) and their Addendum providing “Guidance on certification criteria assessment” (hereinaft er the “Addendum”). (5) Accordingly, the EDPB acknowledges that each certification mechanism should be addressed individually and is without prejudice to the assessment of any other certification mechanism. 1 References to “Member States” made throughout this Opinion should be understood as references to “EEA Member States”. 2 Article 42(1) of the GDPR. 3 Recital 100 of the GDPR. Adopted 4 (6) Certification mechanisms should enable controllers and processors to demonstrate compliance with the GDPR; therefore, the certification criteria should properly reflect the requirements and principles concerning the protection of personal data laid down in the GDPR and contribute to its consistent application. (7) At the same time, the certification criteria should take into account and, where appropriate, be inter - operable with other standards, such as ISO standards, and certification practices. (8) As a result, certifications should add value to an organisation by helping to implement standardized and specified organisational and technical measures that demonstrably facilitate and enhance processing operation compliance, taking account of sector - spec ific requirements. (9) The EDPB welcomes the efforts made by scheme owners to elaborate certification mechanisms, which are practical and potentially cost - effective tools to ensure greater consistency with the GDPR and foster the right to privacy and data protection of data subj ects by increasing transparency. (10) The EDPB recalls that certifications are voluntary accountability tools, and that the adherence to a certification mechanism does not reduce the responsibility of controllers or processors for compliance with the GDPR or prevent SAs from exercising their tasks and powers pursuant to the GDPR and the relevant national laws. (11) The Opinion of the EDPB shall be adopted, pursuant to Article 64(1)(c) of the GDPR in conjunction with Article 10(2) of the EDPB Rules of Procedure, within eight weeks from the first working day after the Chair and the competent SA have decided that the f ile is complete. Upon decision of the Chair, this period may be extended by a further six weeks taking into account the complexity of the subject matter. (12) The EDBP Opinion focusses on the certification criteria. In case the EDPB requires high level information on the evaluation methods in order to be able to thoroughly assess the auditability of the draft certification criteria in the context of its Opinion thereof, the latter does not encompass any kind of approval of such evaluation methods. HAS ADOPTED THE FOLLOWING OPINION: 1 SUMMARY OF THE FACTS 1. In accordance with Article 42(5) of the GDPR and the Guidelines, the “Trusted Site Data Privacy Criteria Catalogue for Inspecting the Conformity of an IT Solution with the European General Data Protection Regulation” (hereinafter the “draft certification criteria” or “certification criteria”) was drafted by TÜV NORD CERT GmbH (hereinafter the “TÜV NORD”), a legal entity in Germany and submitted to the Lande sbeauftragte für Datenschutz und Informationsfreiheit Nordrhein - Westfalen, the competent German supervisory authority in North Rhine - Westphalia (hereinafter the “DE SA” or “competent SA” ). 2. The DE SA has submitted the draft criteria of a national certification scheme to the EDPB and requested an Opinion of the Board pursuant to Article 64(1)(c) GDPR on 28 April 2025. The decision on the completeness of the file was taken on 17 June 2025. Adopted 5 3. The present certification criteria have a general scope and are not limited to specific processing operations. Certification of processing operations carried out by controllers and processors is possible. 4. Certification of joint controllers under Article 26 GDPR is excluded from the scope of the certification criteria. Furthermore, certification is not available for companies that do not have an establishment within the EEA. 5. The EDPB notes that the present certification is not a certification according to Article 46(2)(f) of the GDPR meant for international transfers of personal data. It does not provide appropriate safeguards within the framework of transfers of personal data to third countries or international organisations under the terms referred to in letter (f) of Article 46(2). Indeed, any transfer of personal data to a third country or to an international organisation, shall take place only if the provisions of Chapter V of the GDPR are respected. 2 ASSESSMENT 6. The Board has conducted its assessment in line with the structure foreseen in Annex 2 to the Guidelines (hereinafter “Annex”) and its Addendum. Where this Opinion remains silent on a specific section of the draft certification criteria, it should be read a s the Board not having any comments and not asking the DE SA to take further action. 2.1 GENERAL REMARKS 7. The Board notes that several criteria contain outdated cross - references to deleted items (e.g., DP06.15 referencing DP06.18), which could hinder accurate evaluation. The Board recommends the DE SA to require the scheme owner to review and correct all references so they point only to existing and valid criteria. 8. The Board notes that in criterion DP01.01, the wording “The IPS is documented to a sufficient extent and it is sufficiently up to date” is use d. Furthermore, the criterion states that “The processor must communicate changes to the IPS [...] with sufficient notice (at least 14 days) [...]”. The term “sufficient” also appears in other criteria (for example, DP02.01 and DP02.04), but its precise me aning is not always defined. As a result, consistent auditability of these requirements does not appear to be ensu red in all cases. The Board therefore recommends the DE SA to require the scheme owner to clarify the precise meaning of “sufficient” in the respective context. 9. Moreover, criterion DP02.02 , along with other similar instances , refers to “appropriate processes” without defining what those processes entail. From the Board’s perspective, this approach reduces clarity and may lead to inconsistent interpretations. Therefore, the Board recommends the DE SA to require the scheme owner to define, for each occur rence of “appropriate processes ” , the specific process elements necessary to render the criterion fully auditable. 2.2 SCOPE OF THE CERTIFICATION MECHANISM AND TARGET OF EVALUATION (TOE) 10. The EDPB recalls that, when a processor – certified under the TÜV certification scheme – engages a sub - processor, the latter cannot claim that it has been certified under TÜV Adopted 6 certification scheme. Only processing operations performed by the initial and certified processor are covered by the certification in such a case. 11. Furthermore , the Board notes that the certification criteria do not clearly indicate whether sub - processors can be certified under the scheme. In particular, the certification criteria do not entail specific criteria dedicated to sub - processors. In cases where the applicant to the scheme is a sub - processor, the Board considers that some criteria would not be applicable. For example, in case of a data breach, criteri on DP09.01 would not be applicable and there should be specific criteria adapted to the certification of sub - processors where the processor shall be notified by the sub - processor. In case sub - processors are eligible to certification, th e Board therefore recommends the DE SA to require the scheme owner to develop specific criteria to take into account the specificities of sub - processing 4 . This would result in a stand - alone and independent procedure 5 . 2.3 GENERAL REQUIREMENTS 12. The Board notes that criteria DP04.08, DP06.03, DP06.07, and subsequent ones, as well as D10.04, stipulate that the processor shall support the controller – for example in the context of consent management, the exercise of data subject rights, and the conduct of data protection impact assessments. However, the wording appears to be rather general, and there are no detailed criteria specifying what this assista nce obligation entails. As a result, consistent auditability of these requirements does not appear to be ensured 6 . Therefore, t he Board recommends the DE SA to require the scheme owner to further clarify the assistance obligations of processors in relation to the respective criterion. 2.4 LAWFULNESS OF PROCESSING 13. The Board notes that under criterion DP03.01, regarding lawfulness of processing, “The controller provides for Lawful Processing of PD only in accordance with one or more of the following conditions” before further enumerating the legal bases for processin g. However, this phrasing does not accurately reflect the wording of Article 6(1) GDPR which states that “Processing shall be lawful only if and to the extent that at least one of the following applies”. T o ensure consistency with GDPR, t he Board therefore recommends the DE SA to require the scheme owner to amend DP03.01 to more closely align with the text of Article 6(1). 14. The Board welcomes the reference to the reasonable expectations of the d ata subjects in criterion DP 02.02, paragraph 14 (similarly i n the "Evaluation note" regarding DP03.07 and DP10.01, as well as in the definition of the terms "Fairness and transparency"). For example, the Board notes that, in criterion DP02.02 , paragraph 14, the certification criteria state taking into account "whether the data subjects can reasonably foresee at the time of the collection of the personal data and the circumstances of the processing that processing may take place 4 See EDPB Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria, adopted on 19 September 2023, paragraph 15. 5 See EDPB Opinion 19/2024 on the EuroPrise criteria of certification regarding their approval by the Board as European Data Protection Seal, adopted on 16 July 2024, paragraph 7. 6 See EDPB Opinion 26/2024 on the draft decision of the DE Bremen Supervisory Authority regarding the “Catalogue of Criteria for the Certification of IT - supported processing of Personal Data pursuant to art 42 GDPR (‘GDPR – information privacy standard’)” presented b y datenschutz cert GmbH, adopted on 2 December 2024, paragraph 24. Adopted 7 for this purpose". As far as the reasonable expectations of the data subjects are concerned, the Board considers that the relationship of the data subjects with the controller (e.g. "in situations such as where the data subject is a client or in the servic e of the controller ") is a criterion stemming directly from Recitals 47 and 50 GDPR. Therefore, to ensure compliance with the GDPR as well as auditability of the certification criteria, the Board recommends the DE SA to require the scheme owner to take int o account the provisions of Recitals 47 and 50 GDPR so as to further develop the criteria and guarantee that the relationship of the data subjects with the controller is duly taken into account to assess the reasonable expectations of the data subjects. 15. With respect to draft criterion DP04 on “Consent”, the Board notes some inconsistencies with the wording that could cause confusion on the nature of the legal obligations embedded in Articles 7 and 8 GDPR. The Board notes that the scheme, in the “Definitio n of requirements” s ections, uses sentences such as “The declaration of consent used is provided in easily accessible, clear and plain language, visibly separated from other matters” (criterion DP04.02), or, “There is a process for providing proof that the data subject has given consent” (criterion DP04.03). While, for example, in criterion DP04.08, it states that “In the case of an information society service offered directly to a child, the processing of the child's personal data is lawful if the child ha s reached the age of sixteen and the child has given consent to the processing”. In this regard, the EDPB encourages the DE SA to require the scheme owner to adapt criterion DP04, to ensure that the wording of the relevant sections reflect the nature and s cope of the oblig ations of Article 7 GDPR (conditions for consent) and 8 GDPR (conditions applicable to child's consent in relation to information society services). 2.5 PRINCIPLES, ARTICLE 5 16. With regard to Section DP02 (“Principles relating to processing”), the Board notes that the principles set out in article 5 GDPR are not consistently and explicitly referenced throughout the dedicated criteria, which may hinder the reading and understanding of the criterion 7 . F or example , while the scheme defines requirements for processing carried out in a “fair and transparent manner” (criterion DP02.02), it does not address the principle of fairness as a distinct element to be assessed independently under Article 5(1)(a) 8 . Therefore , the Board recommends the DE SA to require the scheme owner to refer more spe cifically to the principles in A rticle 5 GDPR and to further develop specific, precise and auditable criteria, based on all the elements listed in section 3.3 of the EDPB Guidelines 4/2019 on A rticle 25 GDPR regarding Data Protection by Design and by Default, adopted on 20 October 2020 . 17. The Board notes that the draft criteria (e.g. DP02.01, DP02.02 and DP06.07 ) aim at covering, inter alia, the information to be provided to data subjects under the GDPR, in the context of compliance with the principles set by Article 5(1)(a). However, the criteria do not always 7 See EDPB Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria , adopted on 19 September 2023, paragraph 24. 8 See for example the elements - listed by the Board - that need to be taken into account in order to comply with the principle of fairness in EDPB Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, adopted 20 October 2020 , paragraph 70; See also EDPB Opinion 18/2024 o n the draft decision of the Austrian Supervisory Authority regarding DSGVO - zt GmbH certification criteria , adopted on 16 July 2024, paragraph 22; EDPB Opinion 26/2024 on the draft decision of the DE Bremen Supervisory Authority regarding the “Catalogue of Criteria for the Certification of IT - supported processing of Personal Data pursuant to art 42 GDPR (‘GDPR – information privacy standard’)” presented by datenschutz ce rt GmbH , adopted on 2 December 2024, paragraph 14. Adopted 8 clearly specify when and how the required information must be provided, as they refer to different timeframes for doing so 9 . In contrast, criteria DP02.01 and DP02.02 make no reference to timing. The Board recalls the provisions of Article 13 and 14 GDPR which provide further details on the obligations of controllers, as well as its previous guidance related to "Key design and default elements for the principle of transparency" 10 . In addition, th e Board notes that criterion DP02.02 refers to profiling and states that “the information must be provided at the time the PD is collected or, in the case of indirectly collected data, the time frame pursuant to Art. 14 para. 3 lit. a to c GDPR m ust be ensured”. In this regard , it is unclear to the Board whether this obligation is limited to situations of profiling, or if it covers all processing operations. Therefore, the Board recommends the DE SA to require the scheme owner to include in the criteria further information and details about when and how the Controller shall fulfil GDPR information obligations. 18. In relation to criterion DP02.05 on further processing, the Board notes that, when listing the possible technical and organisational measures to be implemented, the scheme owner includes, inter alia, “Access and authorisation concept” and “Access and acces s controls”. The Board notes that these two measures cannot be clearly differentiated. In addition, the EDPB considers unclear what the scheme owner means with the definition of “data protection concept”. The Board, therefore, encourages the competent SA t o require the scheme owner to clarify the differences between "Access and authorisation concept" and "Access and access and controls". The Board, moreover, encourages the DE SA to require the scheme owner to provide clarifications on the meaning of “data protection concept”. 19. The Board welcomes criterion DP02.06 on data minimisation and the reference to the obligations that this principle entail s . However, the Board also notes that while important aspects such as pseudonymisation and anonymisation are mentioned and appear to be auditable , other aspects are left more general (see bullet points under criterion DP02.06) 11 . Th erefore, for completeness and auditability , the Bo ard encourages the DE SA to require the sc h e me owner to further develop specific, precise an d auditable criteria regarding data minimisation. 2 .6 RIGHTS OF THE DATA SUBJECT 20. Criterion DP06.05 addresses the information obligation under Article 14 GDPR. However, the criterion does not elaborate on the specific point in time at which, according to Article 14(3) GDPR, the information must be provided. Therefore, the Board recommends the DE SA to require the scheme owner to ensure that the criteria reflect the requirements set out in Article 14(3) GDPR. 21. Criterion DP06.06 addresses the information obligations under Articles 13(3) and 14(4) GDPR. In this context, Article 14(3) GDPR is mentioned in the criterion . H owever, the Board recommends correcting this reference to Article 14(4) GDPR. Regarding the provision in 9 F or example, criterion DP06.04 refers to providing information “before collection” while DP06.07 requires it “without undue delay, and in any case within one month of receipt of the request.” 10 EDPB Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, adopted on 20 October 2020 , in particular the fact that "Information should be provided at the relevant time and in the appropriate form ”, paragraph 66. 11 See for additional guidance, EDPB Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, adopted on 20 October 2020 , Section 3.5. Adopted 9 criterion DP06.06 s tating that the controller “documents a consideration in which it states that the processing for the other purpose is compatible with that for which the PD were originally collected, cf. requirement DP03.08”, the Board recommends the DE SA to require th e scheme owner to clarify who the data subjects are in this context. 22. Furthermore, criterion DP06.08 sets out requirements for providing a copy of the personal data undergoing processing within the meaning of Article 15(3) GDPR. The EDPB considers that the procedure for providing the copy of personal data is not entirely clear and the Board recommends the DE SA to require the scheme owner to clarify how the copy will be provided 12 . 23. Finally, under DP06.15 (right to object), the criterion requires the “definition of personnel responsibilities to ensure that an objection to the processing of personal data is realized within one month.” The Board finds this formulation imprecise , in particular the term “realized”, as it conflates the obligations of Articles 12(3) - (4) GDPR (to “provide information on action taken (…) without undue delay and in any event within one month of receipt of the request”) with the obligation to cease processing un der Article 21 GDPR. The Board therefore recommends the DE SA to require the scheme owner to elaborate DP06.15 by developing criteria that take into account the different steps to be taken to fulfil the right to object and the associated information obligations . 2.7 TECHNICAL AND ORGANISATIONAL MEASURES GUARANTEEING PROTECTION 24. The Board notes that the criteri a explicitly states its alignment with the baseline of international standards for technical and organisational measures, such as ISO/IEC 27001 and the BSI IT - Grundschutz, which establish a formal procedure for the performance of penetration testing. The Bo ard additionally notes that criterion DP08.01 requires that the controller and the processor verify the effectiveness of implemented measures through documented penetration testing, complemented by vulnerability scans, conf iguration analyses, and application - level testing. However, when the criterion states that "the results of these tests must be analysed, evaluated, and prioritised" in the context of penetration test results, it is not clear to the Board whether this oblig ation is included in the "risk management plan" referenced later in the context of vulnerability scans. The Board notes that vulnerability scanning, assessment, prioritisation, remediation, verification, and documentation is a ll process that must be encomp assed within a broader risk and mitigation management plan. The Board encourages the DE SA to require the scheme owner to clarify the linearity of the mitigation procedure, and whether the process for analysing penetration test results is part of the broader risk management plan or applies specifically to the individual procedures for vulnerability scans. 25. In relation to criteria DP08.01 and DP08.02, the scheme owner refers to the BSI standard, whose risk categories are explicitly defined in the evaluation note 13 . However, when stating the obligation to carry out annual penetration tests, the criterion requires a "high protection requirement," which is not clear to the Board if it follow s the same risk level nomenclature as 12 See also CJEU, j udgment of 4 May 2023, Case C - 487/21, F.F. v Österreichische Datenschutzbehörde and CRIF GmbH ( ECLI:EU:C:2023:369) . 13 See EDPB Opinion 25/2022 regarding the E uropean Privacy Seal (EuroPriSe ) certification criteria for the certification of processing operations by processors, adopted on 13 September 2022 , paragraph 30, as it addresses the need of the scheme owner to classify the risks in categories. Adopted 10 that used for the vulnerability assessment. If this is not the case , the criteria should include the levels used in the risk assessment matrix to be able to make a comparison between different protection requirements. Therefore, the Board encourages the DE SA to require the scheme owner to clarify the terminology used and ensure consistency across the criteria with respect to risk categorisation, so as to avoid ambiguity in implementation and evaluation. 3 CONCLUSIONS / RECOMMENDATIONS 26. By way of conclusion, the EDPB considers that the present certification criteria may lead to an inconsistent application of the GDPR and the following changes need to be made in order to fulfil the requirements imposed by Article 42 of the GDPR in light of the Guidelines and the Addendum: 1. Regarding the “general remarks”, the Board recommends that the DE SA requires the scheme owner to: a. review and correct throughout the certification scheme, all references made; b. clarify throughout the certification scheme, the precise meaning of “sufficient” in the respective context; c. define throughout the certification scheme, for each occurrence of the expression “appropriate processes”, the specific process elements entailed, for auditability purposes; 2. Regarding the “scope of the certification mechanism and target evaluation (ToE)” the Board recommends that the DE SA requires the scheme owner to: a. include in the certification scheme specific criteria that take into account the specificities of sub processing or, in the alternative, indicate, in the introductory part, that sub - processors cannot be certified under the certification scheme; 3. Regarding the “general requirements” the Board recommends that the DE SA requires the scheme owner to: a. include more specific criteria for the assistance obligations of processors in relation to the respective criterion; 4. Regarding the “lawfulness of processing” the Board recommends that the DE SA requires the scheme owner to: a. amend criterion DP03.01 to more closely align with the text of Article 6(1) GDPR; b. further develop the criteria and guarantee that, in line with Recitals 47 and 50 GDPR, the relationship of the data subjects with the controller is duly taken into account to assess the reasonable expectations of the data subjects; 5. Regarding the “principles, Article 5” the Board recommends that the DE SA requires the scheme owner to: a. in section DP02 of the certification criteria, refer more specifically to the principles in Article 5 GDPR and further develop specific, precise and auditable criteria, based on all the elements listed in the EDPB Guidelines 4/2019 on Article 25 GDPR regar ding Data Protection by Design and by Default, adopted on 20 October 2020; Adopted 11 b. include in the criteria further information and details about when and how the controller shall fulfil GDPR information obligations, in particular Articles 13 and 14 GDPR, and EDPB Guidelines 4/2019 on Article 25 GDPR regarding Data Protection by Design an d by Default, adopted on 20 October 2020; 6. Regarding the “rights of the data subject” the Board recommends that the DE SA requires the scheme owner to: a. ensure that criterion DP06.05 reflect the requirements set out in Article 14(3) GDPR; b. in criterion DP06.06, delete the reference to Article 14(3) GDPR and correct this reference to Article 14(4) GDPR; c. in criterion DP06.06, where it states that the controller “documents a consideration in which it states that the processing for the other purpose is compatible with that for which the PD were originally collected, cf. requirement DP03.08”, clarify who the data subjects are in this context; d. in criterion DP06.08, where requirements for providing a copy of the personal data undergoing processing are set out, clarify how the copy will be delivered; e. in criterion DP06.15 , develop criteria that take into account the different steps to be taken to fulfil the right to object and the associated information obligations of the controller under Articles 12(3) - (4) and 21 GDPR; Finally, in line with the Guidelines the EDPB also recalls that, in case of amendments of the Trusted Site Data Privacy (TÜV IT) certification criteria involving substantial changes, the DE SA will have to submit the modified version to the EDPB in accordance with Articles 42(5) and 43(2)(b) of the GDPR. 4 FINAL REMARKS 27. This Opinion is addressed to the DE SA and will be made public pursuant to Article 64(5)(b) of the GDPR. 28. According to Article 64(7) and (8) of the GDPR, the DE SA shall communicate its response to this Opinion to the Chair by electronic means within two weeks after receiving the Opinion, whether it will amend or mai ntain its draft decision. Within the same period, it shall provide the amended draft decision or where it does not intend to follow the Opinion of the Board, it shall provide the relevant grounds for which it does not intend to follow this Opinion, in whol e or in part. 29. The EDPB recalls that, pursuant to Article 43(6) of the GDPR, the DE SA shall make public the certification criteria in an easily accessible form, and transmit them to the Board for inclusion in the public register of certification mechanisms and data prot ection seals, as per Article 42(8) of the GDPR. For the European Data Protection Board The Chair Adopted 12 (Anu Talus)