# Standards Publication — legal context bundle > Curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/topics/standards-publication-entry-into-force > Sources are cited per item. Verify against the official texts before relying on them. The content discusses how harmonised standards are published and enter into force, which is a distinct procedural topic that deserves dedicated coverage separate from general standards adoption. ## Overview ## Legal Framework The publication and entry into force of harmonised standards in the EU data protection context is governed primarily by Regulation (EU) No 1025/2012 on European standardisation, read in conjunction with Article 42 and Article 43 GDPR. Under Regulation 1025/2012, the European Commission may issue standardisation requests to European Standardisation Organisations (ESOs) — namely CEN, CENELEC, and ETSI — to develop harmonised standards supporting specific EU legislation. Once a standard is adopted by an ESO, it must be published in the Official Journal of the European Union to acquire presumptive legal effect. Article 42(1) GDPR explicitly contemplates data protection certification mechanisms and seals, while Article 42(2) references the possibility of certification issued under Article 43 by accredited certification bodies. The rationale is to provide organisations with a tangible, auditable benchmark demonstrating GDPR compliance, while preserving the GDPR's direct applicability and the primacy of the supervisory authorities' interpretive role. ## Key Developments The European Commission's 2021 standardisation request (M/571) tasked CEN and CENELEC with developing harmonised standards for data protection management, culminating in the EN 12795 series. These standards were published in the Official Journal, triggering their presumptive compliance value under the New Legislative Framework. However, the EDPB has consistently emphasised — including in its Guidelines 07/2020 on controller and processor concepts — that adherence to standards does not relieve controllers of their accountability obligations under Article 5(2) GDPR. The Court of Justice of the European Union in *Schrems II* (C-311/18) reinforced that certification schemes and adequacy mechanisms cannot substitute for substantive adequacy assessments of third-country data protection levels. This establishes a clear boundary: harmonised standards provide operational guidance but do not alter the legal obligations set by the GDPR itself. ## Practical Guidance - **Track Official Journal publications**: Monitor the European Commission's publication of harmonised standard references in the OJ, as only standards listed there carry presumptive compliance value — internal adoption of draft or unpublished standards provides no legal benefit. - **Distinguish certification from standardisation**: Article 42 GDPR certification and adherence to harmonised standards are separate mechanisms; pursuing EN-standard alignment does not constitute formal certification and offers no binding safe harbour. - **Maintain accountability documentation**: Even when implementing harmonised standards, document under Article 5(2) GDPR how the standard's technical measures map to each applicable GDPR obligation, particularly lawful basis, data minimisation, and security under Article 32. - **Verify scope alignment**: Confirm that a published standard's scope actually covers your processing activities — partial applicability does not extend presumptive compliance to uncovered operations. - **Monitor withdrawal and revision notices**: Standards referenced in the OJ can be withdrawn or superseded; reliance on a withdrawn standard eliminates any compliance presumption and must trigger immediate reassessment. ## Case law ### Data Protection Commissioner v Facebook Ireland and Maximillian Schrems *Source: CJEU, C-311/18, 2020-07-16 — https://overview.legal/posts/51470 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311&ref=51470* Invalidated Privacy Shield adequacy decision and upheld validity of Standard Contractual Clauses with additional safeguards required. ### Bundesverband der Verbraucherzentralen v Planet49 GmbH *Source: CJEU, C-673/17, 2019-10-01 — https://overview.legal/posts/51473 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0673&ref=51473* Pre-ticked checkboxes do not constitute valid consent. Consent must be active. ## Guidance ### Guidelines 04/2022 on the calculation of administrative fines under the GDPR *Source: EDPB, edpb-guidelines-on-the-calculation-of-administrative-fines-under-the-gdpr, 2023-05-24 — https://overview.legal/posts/38068 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-042022-on-the-calculation-of-administrative-fines-under-the-gdpr_en* The European Data Protection Board (EDPB) has adopted these guidelines to harmonise the methodology supervisory authorities use when calculating of the amount of the fine. These Guidelines complement the previously adopted Guidelines on the application and setting of administrative fines for the purpose of the Regulation 2016/679 (WP253), which focus on the circumstances in which to impose a fine. The calculation of the amount of the fine is at the discretion of the supervisory authority, ... ### Guidelines 07/2020 on the concepts of controller and processor in the GDPR *Source: EDPB, edpb-guidelines-on-the-concepts-of-controller-and-processor-in-the-gdpr, 2021-07-07 — https://overview.legal/posts/38069 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-072020-on-the-concepts-of-controller-and-processor-in-the-gdpr_en* The concepts of controller, joint controller and processor play a crucial role in the application of the General Data Protection Regulation 2016/679 (GDPR), since they determine who shall be responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice. The precise meaning of these concepts and the criteria for their correct interpretation must be sufficiently clear and consistent throughout the European Economic Area (EEA). The conc... ## Recent developments ### Recordboete voor Instagram na ingrijpen van de EDPB. *Source: EDPB, 2022-09-15 — https://overview.legal/posts/51820* Na de bindende beslissing van het Europees Comité voor de Bescherming van Persoonsgegevens (EDPB) van 28 juli, heeft de Ierse Autoriteit voor de Bescherming van Persoonsgegevens (DPA) haar beslissing met betrekking tot Instagram (Meta Platforms Ireland Limited, ook bekend als Meta IE) aangenomen en een recordboete van 405 miljoen euro opgelegd op grond van de AVG. ### WODC: Rapport Bescherming gegeven Evaluatie UAVG meldplicht datalekken en de boetebevoegdheid *Source: News, 2022-06-30 — https://overview.legal/posts/6300 — original: https://www.rijksoverheids.nl/documenten/kamerstukken/2022/09/06/tk-aanbiedingsbrief-rapport-bescherming-gegeven-evaluatie-uavg-meldplicht-datalekken-en-de-boetebevoegdheid#entry-207* > Het onderzoek laat zien dat de duidelijkheid en toegankelijkheid van de UAVG kritisch wordt beoordeeld. Mede de ‘beleidsneutrale’ invulling van de wet en de korte tijd waarin deze tot stand moest komen hebben daartoe geleid. Wanneer wordt bezien hoe AP en de jurisprudentie nader invulling hebben gegeven aan de normen in de wet is de conclusie dat dit deels is gebeurd, maar voor een ander deel ook nog verder dient te worden uitgewerkt. In het onderzoeksrapport worden daarvan op verschillende pl ### EU-Hof: consumentenbeschermings-verenigingen mogen representatieve vorderingen instellen tegen inbreuken op de bescherming van persoonsgegevens *Source: NL EU Court Expert, 2022-04-29 — https://overview.legal/posts/6306 — original: https://ecer.minbuza.nl/-/eu-hof-consumentenbeschermingsverenigingen-mogen-representatieve-vorderingen-instellen-tegen-inbreuken-op-de-bescherming-van-persoonsgegevens?redirect=%2Fecer%2Fnieuws%3Fq%3Dprivacy%2520OR%2520avg%26f%3D%26t%3D#entry-305* An association representing consumer interests may bring a representative action against the alleged perpetrator of a personal data breach. A specific breach of a data subject's right to the protection of his or her personal data is not required to bring such a claim. In addition, such a claim can be brought independently of whether a data subject has given an order to do so. This is the EU Court's answer to questions from a German court. ### NCTV-nota stand van zaken (informatie)beveiliging n.a.v. ADR-onderzoek *Source: Government, 2025-03-10 — https://overview.legal/posts/50620 — original: https://www.tweedekamer.nl/kamerstukken/kamervragen/detail?id=2025D08616&did=2025D08616* NCTV-nota stand van zaken (informatie)beveiliging n.a.v. ADR-onderzoek "De NCTV verwerkt persoonsgegevens binnen de nu geldende kaders van de AVG. Dit levert overigens wel beperkingen op bij de uitvoering van de taak van de NCTV. Deze beperkingen zullen bij de inwerkingtreding van de WCoTNV grote... ### What Happened to the Risk-Based Approach to Data Transfers? *Source: Future of Privacy Forum, 2022-09-27 — https://overview.legal/posts/6271 — original: https://fpf.org/blog/what-happened-to-the-risk-based-approach-to-data-transfers/#entry-912* The GDPR incorporates the RBA for all obligations of the controller in the GDPR. Where the transfer rules are stated as obligations of the controller (rather than as absolute principles), the RBA of Article 24 therefore applies. Other than the DPAs assume, this is not contradicted by the ECJ in Schrems II nor by the EDPB recommendations on additional measures following the Schrems II judgment, according to Lokke Moerel, Professor of Global ICT Law at Tilburg University and a Dutch Cyber Security ## Related topics - **Personal Data** — https://overview.legal/topics/persoonsgegevens Information relating to identified or identifiable natural persons - **Human Resources** — https://overview.legal/topics/human-resources Processing of employee and HR data - **Public Authority** — https://overview.legal/topics/overheid Government bodies and their data processing activities - **Scientific Research** — https://overview.legal/topics/scientific-research Processing for scientific research purposes - **Law Enforcement** — https://overview.legal/topics/law-enforcement Processing for law enforcement purposes - **Minors** — https://overview.legal/topics/minderjarigen Special protections for children under GDPR --- Generated by overview.legal · https://overview.legal/topics/standards-publication-entry-into-force · 2026-08-22