Article 43 of the GDPR: Certification Bodies

· Updated on · By Bertrand BucelleBertrand Bucelle · 1 min read

Article 43 of the GDPR: Certification Bodies

Article 43 of the GDPR explained

For an organisation to issue GDPR certifications, it must:

  • Be accredited by the supervisory authority (e.g. the French supervisory authority) or by a national accreditation body;
  • Meet defined criteria (competence, independence, impartiality, transparency, etc.);
  • Submit all its assessment criteria and procedures for approval;
  • Be subject to regular checks by the supervisory authority.

The certifications issued must under no circumstances reduce the responsibility of the data controller.

Why This Article is Important for Your GDPR Compliance

Certification issued by an accredited body allows you to guarantee the reliability of your compliance approach. It strengthens the credibility of the assessment conducted and provides official recognition of your commitments.

How to comply with Article 43 of the GDPR?

  • Ensure that the certification body is accredited according to the criteria of Article 43;
  • Familiarise yourself with the frameworks used and the assessment procedures;
  • Anticipate upcoming audits and controls;
  • Integrate this approach into your GDPR governance.

Examples of Article 43 GDPR Application

  • A company obtains an Europrivacy certification issued by an accredited body according to the rules of Article 43;
  • A company rejects a false GDPR certification because the body was not recognised;
  • A sub-processor chooses a certified reference framework issued by an accredited body to prove its compliance.

Related Resources

Accelerate Your Compliance in a Few Clicks

With our all-in-one solution, you can easily accelerate and ensure your compliance:

  • Automate your compliance with our GDPR software
  • Supported or outsourced by our DPO experts
  • Educate your teams with our GDPR training e-learning

Request a demo with an expert

Assess your situation in 15 minutes with our free, no-obligation GDPR self-assessment.

GDPR: Self-assess now