Article 41 of the GDPR: Control of codes of conduct
Article 41 of the GDPR: Control of codes of conduct
Summary
Article 41 of the GDPR provides that codes of conduct may be controlled and monitored by accredited organizations. These entities ensure compliance with the commitments made by members of the code.
Article 41 of the GDPR explained
A code of conduct, to be implemented, may provide for a control mechanism entrusted to a third party organization. This organization must:
- Be accredited by the supervisory authority (such as the CNIL);
- Be independent and competent in the relevant field;
- Offer adequate guarantees in terms of procedures, impartiality and transparency.
He is responsible for monitoring the application of the code, handling complaints and assessing member compliance.
Why is this article important for your GDPR compliance?
Supervised control of codes of conduct guarantees them credibility and them efficiency. By adhering to a code verified by an accredited organization, you benefit from a regulatory safeguard and reinforced support.
How to comply with Article 41 of the GDPR?
- Look for existing codes of conduct with a validated monitoring device;
- Check that the organization in charge is accredited by the CNIL or the EDPS;
- Comply with code requirements and submit to controls;
- Document your membership and compliance efforts.
Examples of application of Article 41 of the GDPR
- An e-commerce federation implements a code of conduct controlled by an independent body;
- A cloud provider adheres to an industry code monitored by an accredited body;
- A healthcare player follows a GDPR standard controlled by a group certified by the CNIL.
Related Resources
Accelerate your compliance in just a few clicks
With our all-in-one solution, you can accelerate and ensure compliance easily:
- Automate your compliance with our GDPR software
- Supported or outsourced by our DPO experts
- Raise awareness among your teams with our GDPR training e-learning
Assess your situation in 15 minutes with our free, no-obligation GDPR self-diagnosis.
