EDPB Guidelines on certification bodies

Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of the General Data Protection Regulation (2016/679)

These guidelines define the role of accreditation in the context of the GDPR and outline the available routes for accrediting certification bodies as per Article 43(1), highlighting key considerations. They provide frameworks for establishing additional accreditation requirements, both when accreditation is managed by the national accreditation body and when handled by the supervisory authority.