GDPR certification: what Article 42 seals are worth

Does GDPR certification exist, and is it worth pursuing?

The GDPR requires no audit, attestation or certificate. Article 42 certification is voluntary, issued for at most three years by accredited certification bodies or the competent supervisory authority. If a customer, tender or regulator asks for "GDPR certification," the first question to answer is which scheme they mean, because the regulation does not define a single certificate that every organization can obtain. The value of a certification depends on three things: whether the scheme is an approved mechanism, whether the requirement in front of you names that scheme or accepts any evidence of compliance, and whether the certified scope covers the processing and systems the customer actually cares about. Ask the requester to state the scheme, the scope and the evidence they will accept before you decide to pursue anything. Certification counts as evidence, not as a substitute for compliance. Under Article 42(4), a certification does not reduce the controller's or processor's responsibility for compliance or the powers of supervisory authorities. The EDPB register of certification mechanisms, seals and marks is the place to confirm whether a scheme is listed and what it covers, and the EDPB register of certification mechanisms, seals and marks lists the approved mechanisms, seals and marks. Check the register entry and the certification body's accreditation rather than relying on a logo or a sales claim. The roles stay separate. Your organization owns its controls and remains accountable for them. An implementation partner such as DeployOpen can prepare systems, configuration, documentation and evidence for an assessment, but it does not issue certificates. Only the certification body issues the certificate, after its own assessment against the approved criteria. Before engaging anyone, confirm with the certification body which evidence it will request, which parts of your environment fall in scope, and whether your systems are ready for that assessment.

Who may certify, and how a scheme is approved

An Article 42 certificate is only as meaningful as the body that issued it and the criteria it was measured against. Four parallel routes shape the market: accredited certification bodies, supervisory authorities, criteria approved by a national authority, and criteria approved by the EDPB. Check each link in the chain before relying on a certificate.

Accredited certification bodies

Most certificates are issued by certification bodies accredited under EN-ISO/IEC 17065/2012, supplemented by the additional requirements of the competent supervisory authority. Accreditation is the body's permission to certify, and it is what gives the certificate standing. Ask the body for its accreditation certificate, its scope, and whether that scope covers the specific scheme you are buying. Confirm status directly with the competent authority or the national accreditation body, not only with the body itself.

Accreditation limited to five years

Article 43(4) limits a certification body's accreditation to a maximum of five years. A body that was accredited when it issued your certificate may have a different status later, so the accreditation period matters as much as the certificate's own validity. Record the accreditation expiry date alongside the certificate date in your vendor file, and ask whether renewal is expected before your next review.

Supervisory authorities as issuers

Certification is not limited to private bodies. The competent supervisory authority may also issue certifications under Article 42, and it holds powers to withdraw a certificate or order a certification body not to issue one. Where a scheme is run by a regulator, the regulator's own published criteria and register are the reference point. Check whether the issuer is a body or the authority itself, because that changes who you contact if the certificate is challenged.

Criteria approved by an authority

The certification criteria themselves must be approved, either by the competent supervisory authority or by the EDPB. A criteria set approved only nationally applies in that jurisdiction's terms, while EDPB approval can lead to a common European Data Protection Seal. Before relying on a scheme, obtain its approved criteria document and confirm which authority approved it, because a certificate is meaningful only against criteria that have actually been approved.

Criteria approved by the EDPB

When the EDPB approves criteria, the result is a common certification known as the European Data Protection Seal. The EDPB publishes its register of certification mechanisms, seals and marks, which lists the schemes approved so far, along with national schemes approved by authorities in several Member States. Use the register as the starting point for verification, then check the certificate's issuer and validity against the scheme's own documentation.

Which certification route fits your situation

This table compares a European Data Protection Seal, a national scheme approved by a supervisory authority, and no certification backed by a documented accountability file. Read each column to see when the route fits, who issues the evidence, and what a customer may ask for. Verify any scheme name in the EDPB register before relying on it, since certification supports compliance but never replaces it.

Question	European Data Protection Seal	National scheme approved by a supervisory authority	No certification, documented accountability file
When it fits	Customers or regulators in several Member States want a seal approved under EDPB criteria, or the processor transfers data outside Europe and may use the seal as a transfer tool	The organization operates mainly in one country whose authority approved a scheme, such as those listed from France, Austria or Germany	No customer or contract requires certification, or the organization is still building its records, DPIAs and security evidence
Who issues it	An accredited certification body under approved criteria, with the EDPB involved in approving the criteria	An accredited certification body or the competent supervisory authority, under criteria that authority approved	Nobody certifies. The organization owns and maintains the evidence itself
Validity	Issued for a maximum of three years and renewable under the same conditions	Issued for a maximum of three years and renewable under the same conditions	No expiry. Records must stay current as processing changes
What the customer may ask for	The certificate, its scope statement, the certification body's name, and the register entry showing the scheme	The certificate, the approving authority, the scope, and confirmation the scheme is listed in the register	Records of processing, DPIAs, processor contracts, security measures, breach procedures and rights request logs
Where to verify	The EDPB register of certification mechanisms, seals and marks	The EDPB register, plus the approving authority's published information	Not applicable. Ask for documents and check them against your own systems
Weak point to check	Confirm the certified scope covers the systems and processing the customer actually uses	Confirm the scheme's scope and whether it applies outside the authority's country	Evidence may not be tested by a third party, so reviewers look closely at gaps and dates
Effect on your responsibility	Supports compliance as one element. The organization remains responsible for compliance	Supports compliance as one element. The organization remains responsible for compliance	Full responsibility stays with the organization, with no external attestation

Validity periods, renewal and checking the EDPB register

An Article 42 certificate lasts for a maximum of three years, and it can be renewed under the same conditions. Renewal is not automatic. The certification body reassesses the target against the criteria, and the certificate must be withdrawn if the requirements are not met or stop being met at any point in that period. For a buyer, the practical question is whether the certificate is still in force on the day a contract is signed, not whether it was valid when the scheme was first announced. Ask the holder for the issue date, the expiry date and the certification body's name, then confirm all three against the public record rather than relying on a PDF copy.

Start with the EDPB register of certification mechanisms, seals and marks, which lists 17 entries as of October 2026. Check that the scheme appears there, that the entry names the certification body or competent authority, and that the scope matches the product or service you are buying. The register also shows the Europrivacy extension for transfers: the EDPB adopted an opinion on 16 April 2026 recognizing the Europrivacy criteria as a European Data Protection Seal usable as a transfer tool under Article 46, and the register lists the extension from 6 August 2026. Confirm the date against the register itself before relying on it in a transfer assessment, because the entry, not a vendor statement, is the authoritative record.

A certificate covers only the scope and target of evaluation named in it. A certified cloud platform does not certify the customer's configuration, the processor's sub-processors outside the named scope, or the customer's own records of processing. When you self-host open-source platforms, ask which components, environments and processing activities sit inside the certified target and which do not. Your own controls and evidence still have to cover everything outside it. Certification also does not replace the independent review you may need for your own obligations, so treat the certificate as one input to your accountability file, with its validity dates and scope recorded alongside it.

How a GDPR certification is pursued, from scoping to certificate

The sequence runs from defining what is being certified to receiving a certificate with a validity date, and each phase produces a written output that the next phase depends on. Certification evidences compliance for the certified target but does not replace the organization's own responsibility for GDPR compliance.

Define the target of evaluation and scope
The organization decides what is being certified: a specific product, service, processing operation or deployment, and the personal data flows, systems, locations and roles (controller or processor) that fall inside it. Scope decisions drive everything after, so the boundary should be written down, including what is excluded and why. The output is a short target of evaluation document that names the processing activities, the systems and the responsible owners. Ask the certification body whether it will accept that boundary before you commit to a scheme.
Select an approved scheme and an accredited body
Certification under Article 42 is issued against criteria approved by a competent supervisory authority or by the EDPB, and certificates come from accredited certification bodies or the supervisory authority itself. Check the EDPB register of certification mechanisms, seals and marks to see which schemes are listed and whether the target processing fits their criteria. Then confirm that the proposed body holds accreditation for that scheme. The output is a written selection record showing the scheme, the accredited body and the accreditation basis. Ask each body for its timeline and fee structure in writing.
Prepare documentation and technical evidence
The organization assembles evidence showing how each criterion of the chosen scheme is met. This typically includes records of processing, data flow descriptions, risk assessments, data protection impact assessments where required, policies, technical and organizational measures, processor contracts, and test or configuration evidence for security controls. Internal staff own this work, and an implementation partner may help prepare systems and collect evidence, but the organization remains accountable for its content. The output is an evidence package mapped criterion by criterion, which the body can check without reconstructing the system.
Undergo the certification body's evaluation
The accredited body reviews the documentation and assesses the target of evaluation against the approved criteria, which may include interviews, system walkthroughs and sample testing depending on the scheme. The evaluation is performed by the body, not the organization or its implementation partner. The output is an evaluation report or set of findings that records what was examined and how. Ask the body to state in writing what evidence it will sample and how it will handle any corrections found during review.
Address findings and complete remediation
Where the body identifies nonconformities or gaps, the organization corrects the affected controls or documentation and provides evidence of the fix. Remediation should address the root cause, not only the single example found, and the organization should record what changed. The output is a remediation log showing each finding, the corrective action, the evidence and the body's acceptance of it. Findings that cannot be closed mean the certificate will not be issued for the current target, so scope and criteria should be reviewed early.
Receive the certificate and track its validity date
When the body is satisfied that the criteria are met, it issues the certificate. Under Article 42(7), certification is issued for a maximum of three years and may be renewed under the same conditions, and it must be withdrawn if requirements are no longer met. The output is the certificate with its issue and expiry dates, which should be recorded in the compliance calendar with a renewal plan. Certification remains a voluntary element that can support accountability and security evidence, and it does not reduce the organization's responsibility for compliance or the powers of supervisory authorities.

What makes certification more expensive or longer

A GDPR certification is priced and timed by the scope of what is assessed, how mature the chosen criteria are, and how ready your evidence is. The drivers below are connected: a wider target of evaluation multiplies the evidence and sites an assessor must check, and weak evidence turns every finding into extra work. Ask for a written scope before comparing quotes.

Target of evaluation scope

The target of evaluation is the set of processing operations and systems the certificate covers. Every additional processing operation, application, database and data flow adds records to review and sampling the assessor must perform. Decide early whether one service or the whole organization is in scope, and document which processing operations sit inside the boundary. A narrow, well-defined target usually costs less to assess and is easier to renew.

Criteria maturity

Certification is measured against approved criteria, and those criteria differ in how long they have existed and how much guidance supports them. Schemes listed in the EDPB register give you a defined set of requirements, but newer or national schemes may have fewer assessors and less published interpretation. Check which criteria the scheme uses, whether the certification body is accredited for them, and how the assessor has handled similar targets before.

Evidence readiness

Assessors test whether controls operate, not whether policies exist. If records of processing, access reviews, change logs, breach procedures and rights request logs are incomplete or scattered, the assessment extends into a reconstruction exercise. Collect evidence from systems on a routine basis, map each criterion to a named artifact, and run an internal review before the assessor arrives. Ready evidence is the cheapest way to shorten the engagement.

Sites and processors

Each site, data center, cloud region and processor that handles the in-scope data adds verification work. Assessors need to see contracts, sub-processor lists and how you oversee them, and the criteria require you to show that processors offer sufficient guarantees. Limit the number of locations and processors inside the boundary where the business allows, and gather their documentation in advance so the assessment does not stall waiting for third parties.

Repeat assessment at renewal

Certification is issued for a maximum of three years and must be renewed under the same conditions. Renewal is therefore a recurring cost, not a one-time event. Ask the certification body how surveillance or re-assessment is performed between issue and renewal, whether changes to the target of evaluation trigger a new review, and how much of the earlier evidence can be reused. Plan for the renewal cycle in the budget from the first quote.

Changes during the assessment

Systems that change while the assessment runs, such as new processors, altered retention settings or new data sources, can reopen areas the assessor has already tested. Freeze the target of evaluation during the audit window where possible, and log every change that affects in-scope processing. Agree with the certification body in writing how mid-assessment changes are handled and whether they alter the timeline or the fee.

Who owns what in a certification project

The organization seeking certification remains the controller or processor responsible for the processing and for every control it relies on. Article 42(4) is explicit that certification does not reduce that responsibility, so no outside party can take over the decisions that matter. Internal ownership covers the scope of the processing being certified, the criteria chosen, the risk judgments behind the controls, and the evidence the organization is prepared to stand behind.

Scope decisions: Choose which processing operations, systems, products and locations fall inside the certification, and document why anything is excluded.
Processing record: Keep the record of processing current, since the certified activities must match it.
Risk and control decisions: Decide which measures address the risks, accept residual risk, and assign named owners for each control.
Policies and governance: Approve the policies, roles and review cycles that the certification body will test.
Renewal and change control: Track when certification expires, which changes trigger notice to the body, and when a new assessment is needed.

Before starting, confirm with the certification body which scope and criteria it will accept, and who inside your organization signs the scope statement.

Why certification does not replace GDPR compliance

A GDPR certification is evidence that a controller or processor has been assessed against approved criteria, not a finding that it is compliant for good. Article 42(4) is explicit that certification does not reduce the responsibility of the controller or processor for compliance, and it does not limit the powers of supervisory authorities. The certificate covers the scope, the criteria and the processing that the certification body actually examined. Anything outside that scope, or any change to the processing after the audit, remains the organization's own problem. Certification also expires: Article 42(7) allows a maximum of three years, and it must be withdrawn if the requirements are no longer met. A seal earned in one year does not carry forward unchanged into the next.

Treating a seal as a shield against complaints or fines is the most common and most costly misreading. A data subject who complains, or a supervisory authority that opens an inquiry, will still ask what the organization actually does with personal data, who can reach it, how long it is kept and how incidents are detected. A regulator assesses the real processing, the records and the decisions behind it. Certification can help: Article 83(2)(j) lists adherence to approved codes or certification as a factor when fines are set, and Article 32(3) allows it to be used as an element in demonstrating security of processing. Those are mitigating factors inside an investigation, not exemptions from one. Before relying on a seal, confirm with the certification body which processing operations and which controller or processor entity the certificate covers.

Certified parties and bodies carry their own exposure. Article 83(4) sets fines of up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher, for infringements of Articles 42 and 43 by controllers, processors or certification bodies. A certification body that issues a certificate without meeting its accreditation conditions, or a holder that misrepresents its scope, can face enforcement, and the authority can order withdrawal under Article 58(2)(h). Procurement teams should therefore ask for the certificate number, its scope statement, its issue and expiry dates, and the body's accreditation details, and check the claimed seal against the EDPB register of certification mechanisms, seals and marks before accepting it in a contract.

How to choose a certification body or consultant

Certification under Article 42 is only worth something if the body that issues it is accredited or approved for that exact scheme and is independent of the work that prepares you for it. The four cards below set out the checks to run before you commit fees or share scope, and the order in which to run them.

Confirm accreditation for the specific scheme

Check that the certification body is accredited by the competent supervisory authority or the national accreditation body, and that its accreditation covers the exact certification scheme you want, not just GDPR in general. Accreditation is granted under EN-ISO/IEC 17065/2012 plus the authority's additional requirements, for a maximum of five years, so ask for the accreditation scope and its expiry date. Verify it with the authority or national accreditation body directly, never with the vendor's own claims. Also check the EDPB register of certification mechanisms, seals and marks for the scheme's listing.

Confirm the body does not also advise you

Ask whether the certification body, or any firm in its group, has designed, implemented or consulted on the controls it will assess. A body that builds your evidence and then certifies it creates a conflict that an assessor should avoid. Separate the roles in writing: the organization owns its controls, an implementation partner prepares systems and evidence, and only the accredited body decides on certification. Ask for a written statement of independence before scoping starts.

Ask for scheme and sector experience

Ask how many certifications under this specific scheme the team has completed, and how many involved your sector and your processing types, such as health data, employee data or cloud-hosted processing. Ask who will assess and whether assessors have worked with the scheme's criteria before. Vague answers about general privacy experience do not show that an assessor understands the criteria you will be tested against. Request named roles and their qualifications rather than only a firm profile.

Request the written scope and evidence list

Before signing, obtain a written scope that names the systems, processing activities, locations, sub-processors and the criteria version to be assessed. Ask for the evidence list the assessor expects, including records, logs, test results and policies, and who in your organization supplies each item. A clear scope and evidence list also makes quotes comparable, since the effort and fee follow from them. Confirm how surveillance, renewal and withdrawal are handled, because certification lasts for a maximum of three years and must be withdrawn if requirements are no longer met.

GDPR certification questions buyers ask

Is GDPR certification mandatory for our organization?

No. The GDPR requires no audit, attestation or certificate, and certification under Article 42 is voluntary. Your obligations exist whether or not you hold a certificate, so the question for most buyers is whether certification would help you demonstrate compliance to a customer or regulator. A customer may ask for a certificate in a contract or tender, but that is a commercial requirement, not a legal one. Read the clause carefully and confirm with your legal team which certification, scheme and scope the customer actually accepts before you invest in one.

Does a GDPR seal or certificate make us compliant?

No. Article 42(4) states that certification does not reduce the responsibility of a controller or processor for compliance, and it does not limit the powers of supervisory authorities. A certificate is an element you can use to demonstrate compliance. Article 24(3), Article 25(3), Article 28(5) and Article 32(3) all recognize approved certification as a supporting element for accountability, data protection by design, processor guarantees and security of processing. Article 83(2)(j) also makes adherence a factor when a regulator sets a fine. Certification therefore strengthens your evidence, but a breach or a rights failure can still lead to enforcement while you hold one.

How long is a GDPR certificate valid?

A certificate under Article 42 is issued for a maximum of three years and may be renewed under the same conditions. Article 42(7) also requires withdrawal where the certification requirements are not or no longer met, so validity depends on continuing conformity, not only on the calendar. Supervisory authorities can withdraw a certification or order a certification body to withdraw or not issue one under Article 58(2)(h). Plan for periodic reassessment and keep your systems, records and processing descriptions current, because a change in processing can put a valid certificate at risk.

Can DeployOpen certify us against the GDPR?

No. DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms, and it prepares systems and evidence for compliance assessments. It does not issue audit reports, attestations or certifications. Under Article 42(5) certificates are issued by accredited certification bodies or the competent supervisory authority, against approved criteria. Certification bodies are accredited under EN-ISO/IEC 17065/2012 plus the authority's additional requirements. Ask any body you consider whether it holds the accreditation that applies in your Member State and whether the scheme it uses is on the EDPB register.

What does a GDPR certification require from our internal team?

Your team owns the controls and the evidence, so the effort is mostly internal. Expect work in these areas:

Defining the scope of processing, the systems involved and the processors and sub-processors used
Documenting security measures, access controls, logging, backup and breach handling so each can be tested
Keeping a current record of processing, data protection impact assessments and processor contracts
Preparing rights request handling and evidence that deadlines are met
Naming an accountable owner who answers the certification body during assessment and surveillance

An implementation partner can prepare systems and evidence, but the certification body needs your organization to be able to stand behind them. Ask any partner for a written scope that lists which items they prepare and which remain with you.

What changes if a customer asks for a European Data Protection Seal?

The European Data Protection Seal is the common certification issued under EDPB-approved criteria (Article 42(5)). The EDPB register lists 17 entries as of October 2026, including seals such as Europrivacy, EuroPriSe and BC 5701:2024, along with national schemes approved in France, Austria and Germany. Confirm which scheme your customer names, because a seal and a national scheme may differ in scope and recognition. Also note that on 16 April 2026 the EDPB adopted an opinion recognizing the Europrivacy criteria as a seal usable as an Article 46 transfer tool, which matters if your customer receives data from outside Europe. Check the register entry and the scheme's scope statement before you start.

How DeployOpen works on this

DeployOpen prepares the systems, controls and evidence that a certification body would examine for GDPR certification, working inside the client's own infrastructure. The certification decision itself belongs to an accredited certification body or supervisory authority, and the organization keeps responsibility for its compliance.

How we scope

Engagements are fixed-scope, with the certification mechanism, target processing activities and systems agreed in writing before work starts.
The written scope names which criteria the client has chosen and which systems, processors and transfers fall inside the boundary.
Scope documents state what DeployOpen will prepare and what the certification body or client must still provide or decide.

How we build

We configure self-hosted platforms so that access control, logging, encryption and retention settings can be shown to an assessor.
Security testing of applications, APIs and infrastructure can be scoped to produce test evidence for the Article 32 measures in the criteria.
Controls are mapped to the chosen certification criteria, with gaps logged and tracked to closure before the assessment begins.

How we hand over

Handover includes configuration records, procedures, test reports and an evidence index organized by criterion.
Documentation is written so the client can maintain it after handover, including records of processing and retention settings.
Ask the certification body in advance which evidence format and sampling approach it expects, and confirm this is in the handover.

How we support

Ongoing support, upgrades and continuous testing are available as retainers, which help keep evidence current through a certificate's validity.
Support can cover re-testing and evidence refresh before a renewal, since certification is issued for a maximum of three years.
Whether support is needed after handover depends on the certification body's conditions and the client's change rate, so confirm this in the written scope.

GDPR certification