Opinion 34/2025 on the draft decision of the Greek Supervisory Authority regarding C.E.C.L certification criteria

02 December 2025 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(c) and Article 42 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”), Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 1 , Having regard to Article 64(1)(c) of the GDPR and Article 10 and Article 22 of its Rules of Procedure , Whereas:

Member States, supervisory authorities, the European Data Protection Board (hereinafter “the EDPB”) and the European Commission shall encourage, in particular at Union level, the establishment of data protection certification mechanisms (hereinafter “certi fication mechanisms”) and of data protection seals and marks, for the purpose of demonstrating compliance with the GDPR of processing operations by controllers and processors, taking into account the specific needs of micro, small and medium - sized ente rpri ses . In addition, the establishment of certifications can enhance transparency and allow data subjects to assess the level of data protection of relevant products and services .

The certification criteria form an integral part of any certification mechanism. Consequently, the GDPR requires the approval of national certification criteria of a certification mechanism by the competent supervisory authority (Articles 42(5) and 43(2)(b ) of the GDPR), or in the case of a European Data Protection Seal, by the EDPB (Articles 42(5) and 70(1)(o) of the GDPR).

When a supervisory authority (hereinafter “SA”) intends to approve a certification pursuant to Article 42(5) of the GDPR, the main role of the EDPB is to ensure the consistent application of the GDPR, through the consistency mechanism referred to in Articl es 63, 64 and 65 of the GDPR. In this framework, according to Article 64(1)(c) of the GDPR, the EDPB is required to issue an Opinion on the SA’s draft decision approving the certification criteria.

This Opinion aims to ensure the consistent application of the GDPR, including by the SAs, controllers and processors in the light of the core elements , which certification mechanisms have to develop. In particular, the EDPB assessment is carried out on the basis “Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation” (hereinafter the “Guidelines”) and their Addendum providing “Guidance on certification criteria assessment” (hereinaf ter the “Addendum”).

Accordingly, the EDPB acknowledges that each certification mechanism should be addressed individually and is without prejudice to the assessment of any other certification mechanism.

Certification mechanisms should enable controllers and processors to demonstrate compliance with the GDPR; therefore, the certification criteria should properly reflect the requirements and principles concerning the protection of personal data laid down in the GDPR and contribute to its consistent application.

At the same time, the certification criteria should take into account and, where appropriate, be inter - operable with other standards, such as ISO standards, and certification practices. 1 References to “Member States” made throughout this document should be understood as references to “EEA Member States”. 3 | Adopted

The EDPB welcomes the efforts made by scheme owners to elaborate certification mechanisms, which are practical and potentially cost - effective tools to ensure greater consistency with the GDPR and foster the right to privacy and data protection of data subj ects by increasing transparency.

The EDPB recalls that certifications are voluntary accountability tools, and that the adherence to a certification mechanism does not reduce the responsibility of controllers or processors for compliance with the GDPR or prevent SAs from exercising their t asks and powers pursuant to the GDPR and the relevant national laws.

The Opinion of the EDPB shall be adopted, pursuant to Article 64(1)(c) of GDPR in conjunction with Article 10(2) of the EDPB Rules of Procedure, within eight weeks from the first working day after the Chair and the competent SA have decided that the file i s complete. Upon decision of the Chair, this period may be extended by a further six weeks taking into account the complexity of the subject matter.

The EDBP Opinion focusses on the certification criteria. In case the EDPB requires high level information on the evaluation methods in order to be able to thoroughly assess the auditability of the draft certification criteria in the context of its Opinion thereof, the latter does not encompass any kind of approval of such evaluation methods. Has adopted the following Opinion: 1 Summary of facts

In accordance with Article 42(5) of the GDPR and the Guidelines, the “CRITERIA FOR CERTIFICATION OF COMPLIANCE WITH THE GDPR FOR PROCESSING OPERATIONS RELATING TO THE PERSONAL DATA OF EMPLOYEES” (hereinafter the “draft certification criteria” or “certifica tion criteria”) were drafted by the CENTRE FOR EUROPEAN CONSTITUTIONAL LAW (C.E.C.L.) - TSATSOS FOUNDATION, a legal entity registered in Greece and submitted to the Greek Supervisory Authority (hereinafter the “EL SA”).

The EL SA has submitted its draft decision approving the certification criteria and requested an Opinion of the EDPB pursuant to Article 64(1)(c) GDPR on 30 September 2025. The decision on the completeness of the file was taken on 17 November 2025.

The draft certification criteria have a limited scope and apply only to specific processing operations. Only c ertification of processing operations carried out by controllers is covered , wh ile certification of processing operations carried out by processors is excluded . 4 | Adopted

The Board notes that t he limited scope of the draft certification criteria covers processing operations regarding employee data in relation to certain topics (recruitment procedures, monitoring of employment status, payroll, trainings, disciplinary procedures, monitoring and evaluation of work performed, transfers of employee data to competent authorities in accordance with the legislation, transfers to third – non - state parties, and management of video surveillance systems). Furthermore, the Board notes th at processing operations in the context of employees’ teleworking are not covered by the scope of the draft certification criteria (See exemptions under A.2) . The Board also notes the exclusion under A.2 of “ processing operations in the context of the implementation of a specific regulatory framework provided for by legislation, such as the management of internal complaints of harassment at work, whistleblowing, etc” from the scope of the draft certification criteria.

Certification of joint controllers under Article 26 GDPR is excluded from the scope of the certification criteria. Furthermore, certification is not available for companies that do not have an establishment within the EEA when they carry out data processing subject to GDPR obligations pursuant to article 3(2) .

The present certification is not a certification according to article 46(2)(f) of the GDPR meant for international transfers of personal data and therefore does not provide appropriate safeguards within the framework of transfers of personal data to third countries or international organisations under the terms referred to in letter (f) of Article 46(2). Indeed, any transfer of personal data to a third country or to an international organisation, shall take place only if the provisions of Chapter V of the G DPR are respected. 2 Assessment

The Board has conducted its assessment in line with the structure foreseen in Annex 2 to the Guidelines (hereinafter “Annex”) and its Addendum. Where this Opinion remains silent on a specific section of the draft certification criteria, it should be read as the Board not having any comments and not asking the EL SA to take further action. 2.1 General Remarks

The Board notes that i n several parts of the draft certification criteria, references are made to “ Law 4624/2019 ” without specifying what this legal act entails. Therefore, the Board encourages the EL SA to require the scheme owner to include a definition or explanatory note describing this law, together with an indication of where it can be publicly accessed.

In the view of the Board, the wording of the draft certification criteria i s not always consistent, as some parts refer to “employee’s personal data” while others refer to “processing operations within the target of evaluation.” Therefore, the Board encourages the EL SA to require the scheme owner to use consistent terminology throughout the document and to systematically refer to “processing operations within the target of evaluation” when formulating the requirements.

Moreover, in several parts of the draft certification criteria, the respective criterion requires compliance with guidelines issued by the EDPB or with endorsed guidelines of the Article 29 Working Party (s ee, for example, Section 1.1.5.1 regarding the minimum content of data protection impact assessments or Section 1.1.9.5 regarding transfers by derogation for special situations ) . T he Board highlights that certification criteria shall constitute a stand - alone document, in which all criteria are sufficientl y and specifically elaborated to ensure that they are auditable. Therefore, for completeness and auditability of the criteria , the Board recommends the EL SA to require the scheme owner to further develop specific, precise, and auditable criteria, and to avoid general references to the obligation to comply with guidelines issued by the EDPB or endorsed guidelines of the Article 29 Working Party 2 .

With respect to section 1.1.10 of the draft certification criteria on “Updates of legislation”, the Board considers not realistic and not auditable to expect immediate policy changes after legal updates. The Board recommends the EL SA to require the scheme owner to amend section 1.1.10 to expect updates without undue delay while also considering a reasonable timeframe (e.g. 30 or 90 days) to remediate. 2.2 Scope of the Certification mec hanism and Target of Evaluation (ToE)

The Board notes that , pursuant to draft certification criterion A.1.2., the territorial scope is (a) “the territory of the Hellenic Republic”, and (b) “ the territory of any country where processing of data of employees who are located in the territory of the Hellenic Republic takes place and provided that the processing activities relate to the monitoring of their conduct as employees, taking place within the Union, or the provision of goods or services to them in their capacity as employees ”. According to the Board , the use of the terms “any country” can lead to confusion as to the scope of the draft national certification criteria. Consequently, the Board recommends the EL SA to require the scheme owner to amend the criteria to clarify that the scope of the scheme is national in accordance with Article 42 ( 5 ) and Art. 56 GDPR .

The Board highlights that the terms “non - state - parties” or “non - state - bodies” may lead to confusion and recommends the EL SA to require the scheme owner to define or clarify the terms “non - state parties” and “non - state - bodies” . 2 See the EDPB Opinion 18/2024 on the draft decision of the Austrian Supervisory Authority (AT SA) regarding the certification criteria of DSGVO - zt GmbH (paragraph 22 ) . 6 | Adopted

T he Board notes the exclusion under A.2 of “processing operations in which advanced technologies, such as TLS appliances, DLPs, blockchain , are used” . However, Section 3 of the draft certification criteria requires encryption, secure protocols (TLS/HTTPS), and modern security measures. The Board considers inconsistent to exclude technologies that are often necessary to meet the requirements of Article 32 GDPR. Therefore, the Board recommends the EL SA to require the scheme owner either to delete the exclusi on in A.2 , or to clarify that the exclusion applies only to certification of the advanced technology itself (e.g. product certification) and not to the use of those technologies where they are aimed at ensur ing a high level of security of personal data . 2.3 Processing operation, Article 42(1)

With respect to section 1.1.3. of the draft certification criteria on “ Personal data subject to processing operations ”, the Board recommends the EL SA to require the scheme owner to add a reference to Article 10 GDPR in the heading in section 1.1.3 .

Furthermore, under section 1.1.3.4 of the draft certification criteria on “ Personal data relating to criminal convictions and offences ”, the Board notes that “the applicant shall demonstrate that they are not processing a complete criminal record” and that a reference is made to national applicable law (i.e. Directive 115 /2001 of the Hellenic DPA). The Board understands this refers to the implementation of the provisions of Article 10 GDPR regarding the conditions under which processing of personal data relating to criminal convictions and offences can be authorised. The Board recommends the EL SA to require the scheme owner to further specify - within the criterion and in connection with the relevant provisions of applicable national law - the appropriate safeguards for the rights and freedoms of data subjects (e.g. access restriction, retention period, possible alternative evidence) when processing of data relating to criminal convictions and offences under section 1.1.3.4 .

The Board notes that it is unclear if criterion 2.2.1.5 fulfil s the requirements of national provisions adopted under Article 88 GDPR, which allows national legislation or collective agreements to provide for more specific rules to ensure the protection of the rights and freedoms of data subjects in respect of the processing of employees’ personal data in the employment context . For instance , criterion 2.2.1.5 regarding the processing of biometric data could lead to the misconception that the monitoring of employees’ work is possible ( see in this regard the target of evaluation No 6) without any specific limitation s concerning the legitimate purposes pursued as well as any explicit reference s to the specific safeguards required by national law, in line with Article 9(2)(b) and 88(2) G DPR 3 .The Board encourages the EL SA to require the scheme owner to precisely determine and refer to the legal requirements provided by national legislation passed in accordance with Article 88 GDPR .

Furthermore, The Board notes that the explanation of the criterion 1.1.5.1 regarding the obligation to carry out a DPIA refers to an extensive list of possible processing activities that may not all be applicable to the scope (for example, some processes may not be per formed at all due to the requirements provided by national legislation passed in accordance with Article 88 GDPR ). Hence, the EDPB encourages the EL SA to require the scheme owner to delete such references from the explanation, to avoid any ambiguities. 3 The generic reference in the title of the criterion to Article 9(2)(a) to (i) seems to allow the processing of employees’ biometric data for the purpose of m onitoring and evaluatio n of their work perform ance outside the boundaries set for by Article 9(2)(b) and 88 GDPR) 7 | Adopted 2.4 Lawfulness of Processing 2.4.1 Legal Basis

The Board notes that in section 2.2 of the draft certification criteria on “Legal basis for the processing of special categories of personal data” the title of these criteria do es refer and analyse Article 9(a) to (i) but they omit to refer to Article 9(d), (e), (h) and (i). The Board considers that this title can be misleading. Therefore, recommends the EL SA to require the scheme owner to modify the title in section 2.2 , in order to include the provisions of Article 9(d), (e), (h) and (i).

The Board takes note of draft certification criterion 2.1.1.1 on “Processing based on consent” which currently states that “ the applicant must prove that the employee's consent to the processing of their data was given freely, in accordance with the conditions of the GDPR, as set out, in particular, in Article 7, as well as the relevant provision of Article 27 (2) of Law 4624/2 019 ”. The Board recalls the usual existence of an imbalance of power in employment context and that it deems problematic for employe rs to process personal data of current or future employees on the basis of their consent as it is unlikely to be freely given 4 . Therefore , the Board recommends the EL SA to require the scheme owner to reserve consent for truly optional, non - essential processing, with a clear, non - detrimental refusal path . 2.5 General Obligations for Controllers and Processors 2.5.1 Obligation applicable to controllers

With respect to the draft certification criterion 1.1.8 on Data Processors, the Board notes that the contract containing the minimum content required under Article 28(3) GDPR shall not only be available or signed at the time of the audit, but already at the time when the processor is entrusted with the processing activities. To this end, the Board recommends the EL SA to require the scheme owner to amend the wording of draft certification criterion 1.1.8 in order to ensure full alignment with the GDPR.

With respect to the draft certification criterion 2.5.3 on Notice of breach to the data subject, the Board notes that the criterion lists measures pursuant to Article 34(3) GDPR envisioned in case “ the applicant does not prove the communication of the breach to the employee - data subject ” . In particular , the applicant must prove that direct communication with the data subject would involve disproportionate efforts. However, considering the scope of the criterion ( i.e. employee’s data ) , the Board considers th at a situation involving such disproportionate efforts would be exceptional . To this end, the Board encourages the EL SA to require the scheme owner to further develop situations where this case may arise . Additionally, the Bord encourages the EL SA to require the scheme owner to clarify that the demonstration related to “disproportionate efforts” - in draft certification criterion 2.5.3 - needs to be made to the certification body. 2.6 Rights of data subjects 4 EDPB guidelines 05/2020 on consent under Regulation 2016/679, version 1.1., Adopted on 4 May 2020, paragraph 21. 8 | Adopted

Regarding section 4.1.3 on “identification of the data subject” (explanation section) , the draft certification criteria refe r to the documentation that shall be provided by the data subject in order to be authenticated in way that might risk to jeopardise the principle of data minimisation 5 . In order to comply with the principle of data minimisation, the Board recommends the EL SA to require the scheme owner to modify the explanation of the draft criteria in section 4.1.3 in order to clearly state that the documentation is to be requested to the data subject only in case of reasonable doubt.

The Board notes that under the explanation part of draft criterion 4.1.3 (in Section 4.1 dedicated to data subjects’ rights) , t he applicant may choose to use biometric data as a method of identification of the data subject. In this case the applicant “ shall document that the conditions of criterion 2.2.1.5 are fulfilled, in particular with regard to the specific security requirements necessitating the processing and the fact that the identification cannot be reliably carried out by milder means ”. The Board highlights that, in principle, the use of biometric data would not be necessary and proportionate for handling the exercise of data subjects’ rights 6 and recommend s the EL SA to require the scheme owner to exclude th e possibility to use biometric data for handling the exercise of data subjects’ rights . 2.7 Risks for the rights and freedoms of natural persons

The Board welcomes the draft criteria 1.1.5.2 on “Data Protection Impact Assessment and Prior Consultation” where the criteria provide that “The applicant must prove (e.g. through the ROPA) that the processing operations they carry out in relation to perso nal data of their employees do not result in a high risk to their rights and freedoms in terms of their nature, scope, context and purposes, in line with Article 35(1) GDPR”. The Board understands from the explanation of these criteria that the applicant s hall include in the ROPA the information about whether a DPIA is required and was conducted accordingly. However, the title of these criteria is “No obligation to carry out a DPIA”. For clarity and accuracy purposes, the Board recommends the EL SA to require the scheme owner to change the title of criteria 1.1.5.2 to reflect the essence of the criteria. 2.8 Technical and organisational measures guaranteeing protection 5 The explanation of the draft certification criteria states the following: “ Α. The applicant must have established a procedure for reliable verification of the identity of the data subjects requesting access to and information about their data and record t he result of this procedure in the Record for Employee Requests they maintai n in accordance with criterion 4.1.5: - identity identifiers such as first name, surname and picture - documents such as identity card, passport, driving licence - knowledge verification, by providing information known only to the subject or not publicly a vailable - digital identification, such as log - in tokens and passwords that may be required for online requests, as defined in criterion 4.1.5 - Combination of the above. 6 See for instance EDPB Guidelines 01/2022 on data subject rights - Right of access , Version 2.1n Adopted on 28 March 2023, paragraph 68 . 9 | Adopted

As to regards to section 3.1.3.1 of the draft certification criteria on “Reliability of logging mechanisms” the Board notes that the criteria, in their current version, are not precise enough as to what categories of data could be processed, since they provide “free field” texts to be completed. The Board is of the Opinion that this might risk jeopardising the principle of data minimisation. Therefore, the Board recommends the EL SA to require the scheme owner to provide clear and precise categories of dat a within the criteri a under section 3.1.3.1, and to remove the possibility to have “free field” texts to be completed.

With respect to draft certification criteri o n 3.2.1.1 on Encryption , the Board notes that the requirement provided in the “DESCRIPTION OF THE CRITERION” column - “Encryption is effective” - lacks the explanation provided for technical standards in other criteria. Therefore, for the purpose of auditability and consistenc y , the Board encourages the EL SA to require the scheme owner to refer to recognised standards or to the explanation part to further develop the criteria.

Concerning section 3.1.2.5 of the draft certification criteria regarding password rotation and entropy, the Board recommends the EL SA to require the scheme owner to ensure that applicant s take into account the latest advances in the state of the art , in line with Article 32 GDPR, when defining the ir password policy.

The Board notes that there are no criteria about encryption of data at rest, though criterion 3.1.4.3 encompasses in - transit data encryption. The Board is of the opinion that data at rest should also be subject to encryption requirements for the draft cert ification criteria to be consistent, taking into account the results of the risk analysis. Therefore, the Board recommends the EL SA to amend the criteria to ensure it also covers encryption of data at rest.

Concerning section 3.1.4.4 of the draft certification with regard to outgoing emails, the Board notes that the criterion only covers file - sharing services. The Board notes that other methods, such as the encryption of attachments, are available. Therefore, the Board encourages the EL SA to require the scheme owner to modify the criterion on outgoing emails to ensure other technical mechanisms are accepted , such as encryption of attachments (e.g. S/MIME, PGP or encrypted archives) or file sharing services ( e.g. client - side encryption sharing services), with documented key management and out - of - band secret sharing. 3 Conclusions / Recommendations

By way of conclusion, the EDPB considers that the present draft certification criteria may lead to an inconsistent application of the GDPR and the following changes need to be made in order to fulfil the requirements imposed by Article 42 of the GDPR in light of the Guidelines and the Addendum: 46 regarding the “general remarks”, the Board recommends that the EL SA requires the scheme owner to: 10 | Adopted 1. clarify the normative value of the “explanation” part ; 2. further develop specific, precise, and auditable criteria, and to avoid general references to the obligation to comply with guidelines issued by the EDPB or endorsed guidelines of the Article 29 Working Party ; 3. amend section 1.1.10 to expect updates without undue delay while also considering a reasonable timeframe (e.g. 30 or 90 days) to remediate ; 47 regarding the “scope of the certification mechanism and target evaluation (ToE)”, the Board recommends that the EL SA requires the scheme owner to: 1. require the scheme owner to amend the criteria to clarify that the scope of the scheme is national in accordance with Article 42 ( 5 ) and Art. 56 GDPR ; 2. define or clarify the terms “non - state parties” and “non - state - bodies” ; 3. either to delete the exclusion in A.2, or to clarify that the exclusion applies only to certification of the advanced technology itself (e.g. product certification) and not to the use of those technologies where they are aimed at ensuring a high level of security of personal data ; 48 regarding the “processing operation, Article 42(1)”, the Board recommends that the EL SA requires the scheme owner to: 1. add a reference to Article 10 GDPR in the heading in section 1.1.3 ; 2. further specify - within the criterion and in connection with the relevant provisions of applicable national law - the appropriate safeguards for the rights and freedoms of data subjects (e.g. access restriction, retention period, possible alternative evid ence) when processing of data relating to criminal convictions and offences under section 1.1.3.4 ; 49 regarding the “legal basis” the Board recommends that the EL SA requires the scheme owner to: 1. modify the title in section 2.2, in order to include the provisions of Article 9(d), (e), (h) and (i) ; 2. reserve consent for truly optional, non - essential processing, with a clear, non - detrimental refusal path ; 50 regarding the “general obligations for controllers and processors” the Board recommends that the EL SA requires the scheme owner to : amend the wording of draft certification criterion 1.1.8 in order to ensure full alignment with the GDPR ; 51 regarding the “rights of data subjects” the Board recommends that the EL SA requires the scheme owner to: 1. modify the explanation of the draft criteria in section 4.1.3 in order to clearly state that the documentation is to be requested to the data subject only in case of reasonable doubt ; 2. exclude th e possibility to use biometric data for handling the exercise of data subjects’ rights ; 52 regarding the “risks for rights and freedoms of natural persons”, the Board recommends that the EL SA requires the scheme owner to: change the title of criteria 1.1.5.2 to reflect the essence of the criteria ; 11 | Adopted 53 regarding the “technical and organisational measures guaranteeing protection” the Board recommends that the EL SA requires the scheme owner to: 1. provide clear and precise categories of data within the criteri a under section 3.1.3.1, and to remove the possibility to have “free field” texts to be completed ; 2. ensure that applicants take into account the latest advances in the state of the art , in line with Article 32 GDPR, when defining their password policy ; 3. amend the criteria to ensure it also covers encryption of data at rest . 54 Finally, in line with the Guidelines the EDPB also recalls that, in case of amendments of the criteria for certification of compliance with the GDPR for processing operations relating to the personal data of employees of Centre for European Constitutional Law (C.E.C.L.) - Tsatsos Foundation involving substantial changes, the EL SA will have to submit the modified version to the EDPB in accordance with Articles 42(5) and 43(2)(b) of the GDPR. 4 Final remarks 55 This opinion is addressed to the EL supervisory authority and will be made public pursuant to Article 64 (5) (b) GDPR. 56 According to Article 64 (7) and (8) GDPR, the supervisory authority shall communicate to the Chair by electronic means within two weeks after receiving the opinion, whether it will amend or maintain its draft decision. Within the same period, it shall prov ide the amended draft decision or where it does not intend to follow the opinion of the Board, it shall provide the relevant grounds for which it does not intend to follow this opinion, in whole or in part. The supervisory authority shall communicate the f inal decision to the Board for inclusion in the register of decisions , which have been subject to the consistency mechanism, in accordance with article 70 (1) (y) GDPR. 57 The EDPB recalls that, pursuant to Article 43(6) of the GDPR, the EL SA shall make public the “CRITERIA FOR CERTIFICATION OF COMPLIANCE WITH THE GDPR FOR PROCESSING OPERATIONS RELATING TO THE PERSONAL DATA OF EMPLOYEES” in an easily accessible form, and tr ansmit them to the Board for inclusion in the public register of certification mechanisms and data protection seals, as per Article 42(8) of the GDPR. For the European Data Protection Board The Chair Anu Talus