GDPR certification clarifications by EDPB
August 2023. Photo by myself.

GDPR certification clarifications by EDPB

Cesare Gallotti Cesare Gallotti

Cesare Gallotti

Consultant in information security, Lead auditor ISO/IEC 27001, ISO 9001, ISO/IEC 20000; CISA, ITIL Expert, CBCI

发布日期: 2023年9月7日
+ 关注

European Data Protection Board issued some clarifications about the #GDPR #certification: https://edpb.europa.eu/our-work-tools/our-documents/letters/edpb-letter-accredia_en.

Text is very technical and more important for certification bodies than for organizations. Here my highlights:

  • EDPB repeats that its duty is to evaluate certification criteria, not the accreditation activities because this is the duty of national supervisory authorities;
  • the "scheme owner" can be a certification body (for Europrivacy, the scheme owner is Europrivacy itself);
  • the accreditation is required for each state (and by each relevant Supervisory authority or national accreditation body) where the certification body works; this can be difficult, considering that EU states are 27 and maybe in the future a mechanism will be implemented for ease this duty.

Infosec & Quality Infosec & Quality

Infosec & Quality

2,219 位关注者

订阅
Giovanni Francescutti

Global Technical Manager

1 年

Dear Cesare, just a clarification. For point 3 EDPB writes: "Accreditation for a European Data Protection Seal shall occur in the Member State where the certification body intending to operate the scheme has its’ headquarters. Where other establishments or offices manage and perform certifications autonomously, each of these establishments or offices will require separate accreditation in the Member State where they are based". If the Certification body offices are in other establishments, but not acting autonomously (read: under the responsibility of the HQ dealing directly with Qualification, Technical Approval, Rules and Procedures, etc.), it is allowed to issue certificates in all member states using the HQ's Accreditation.

赞
回复
查看更多评论

要查看或添加评论，请登录

Cesare Gallotti的更多文章

社区洞察

其他会员也浏览了