Certification

GDPR certification is a voluntary tool that independently verifies that your organisation handles personal data responsibly, securely and in line with the GDPR. It is awarded by an accredited certification body, and it helps you:

• Build trust and credibility with customers, partners and regulators
• Make compliance easier, with a recognised benchmark to follow
• Strengthen risk management
• Show that data protection is built in from the start
• Demonstrate due diligence in case of a complaint, breach or investigation

Want to know more? Read about GDPR certification (PDF)

Certification can be used as a safeguard when transferring personal data outside the EEA, but you remain responsible as the data exporter. Your obligations start before the transfer takes place and continue throughout the processing lifecycle.

In practice, you must verify that the importer’s certification is valid and covers your specific transfer, secure legally binding commitments that give individuals enforceable rights, and assess whether local laws could undermine the safeguards in place. You must also ensure that the importer notifies you of government access requests and that individuals can seek redress, including by lodging a complaint with a European data protection authority.

Want to know more? Read about data transfers and certification (PDF)