GDPR

Who has to comply

Controllers and processors established in the EU or EEA, regardless of where processing happens, and non-EU organizations that target or monitor people in the EU. Small organizations are exempt from Article 30 records only if they have fewer than 250 employees and their processing is occasional, low risk and does not involve special categories.

What the assessor asks to see

Records of processing activities; lawful basis analysis and consent records; privacy notices; processor agreements and sub-processor lists; data protection impact assessments; DPO designation and reports; data subject request logs; security policies and Article 32 measures; breach register and notifications; international transfer tools and transfer impact assessments; training records; for certification, the scheme's specific criteria evidence.

Where the requirement sits: Art 5(2) accountability; Art 24 policies; Art 30 RoPA; Art 32 security; Art 35 DPIA; Art 39(1)(b) awareness/training

Article 42 certification

Certification is voluntary and does not reduce liability. The EDPB register lists approved mechanisms, including Europrivacy (an EU-wide European Data Protection Seal, with updated criteria approved in EDPB Opinions 14/2026 and 15/2026, the latter for use as a transfer tool by non-EEA importers), GDPR-CARPA (Luxembourg) and national schemes in Germany, Austria, France and the Netherlands.

Check the register for the current list and the accredited certification bodies for each scheme.