Certification

Legal Framework

Data protection certification mechanisms are established primarily under Article 42 GDPR, which provides for the creation of data protection seals and marks to demonstrate compliance with the Regulation. The practical significance of certification, however, is felt across multiple provisions. Article 24(3) establishes that adherence to approved certification mechanisms may serve as evidence of a controller's compliance with its overarching accountability obligations. Article 25(3) extends the same logic to data protection by design and by default, and Article 32(3) does the same for security of processing.

The core idea is straightforward: certification operates as a compliance tool, not a safe harbour. A controller or processor that obtains an approved certificate gains a demonstrable element of compliance — but the responsibility remains squarely with the controller. As the GDPR text makes clear:

"Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the controller."
— GDPR Art. 24(3)

The same formulation appears in Article 25(3) for data protection by design and in Article 32(3) for security, giving certification a cross-cutting evidentiary role.

Certification criteria must be approved by the competent supervisory authority or, in the case of a European Data Protection Seal, by the EDPB. The EDPB has emphasized this requirement:

Key Developments

The CJEU's ruling in Schrems II underscored the limits of self-certification schemes in the international transfer context. The Court scrutinized the Privacy Shield framework, which depended on companies' self-certification of adherence to data protection principles. As the Commission itself had acknowledged:

This highlights a critical distinction: voluntary self-certification does not equate to the kind of approved certification mechanism contemplated by Article 42, which requires independent assessment by an accredited certification body and criteria approved by a supervisory authority or the EDPB.

The EDPB's consistency mechanism under Articles 63–65 GDPR means that any supervisory authority's draft decision approving certification criteria is subject to EDPB review. This ensures that national certifications do not fragment the internal market.

Status of the Debate

Certification as a legal concept is well-established in the GDPR text, but its practical application remains actively contested. The EDPB is still developing the consistency framework for approving certification criteria, with opinions on schemes such as Europrivacy and C.E.C.L. representing early attempts to define the substantive boundaries. Courts have not yet squarely addressed the evidentiary weight of an Article 42 certificate in enforcement proceedings — whether it creates a rebuttable presumption, a mere factor in the balancing, or something stronger remains unresolved. What would settle this is a CJEU reference on the probative value of certification in the context of Article 24(3) or Article 32(3), clarifying whether a valid certificate shifts any burden of proof onto the supervisory authority.

Practical Guidance

• Treat certification as evidentiary, not exculpatory: Under Article 24(3), an approved certificate is "an element by which to demonstrate compliance" — it does not relieve the controller of responsibility. Maintain your own internal accountability documentation independently.
• Verify the certification body's accreditation: Only certificates issued by bodies accredited under Article 43 GDPR, using criteria approved by a competent supervisory authority or the EDPB, carry evidentiary weight under Articles 24(3), 25(3), and 32(3).
• Map certification to specific obligations: Identify which processing activities and which articles (24, 25, 32) the certificate covers. A certificate addressing security under Article 32 does not automatically evidence compliance with data protection by design under Article 25.
• Distinguish self-certification from approved certification: The Schrems II ruling demonstrates that voluntary self-certification schemes lacking independent oversight and authority-approved criteria will not withstand scrutiny. Ensure any certification you rely on meets the full Article 42/43 requirements.
• Monitor EDPB consistency opinions: Because certification criteria approval triggers the consistency mechanism, track EDPB opinions — such as those on Europrivacy and C.E.C.L. — to anticipate the substantive standards that will govern future certifications.