Innovative Certification Model

Innovative Certification Model

Europrivacy provides an innovative hybrid model of certification that benefits from the advantages of a universal certification scheme complemented by domain-specific and technology-specific criteria, according to the nature of the Target of Evaluation.

Europrivacy innovative certification model

GDPR Core Criteria (G/GI): The certification process always starts with the Europrivacy list of GDPR Core Criteria, encompassing the various GDPR obligations, as explained below:

  • Lawfulness of Data Processing
  • Special Data Processing
  • Rights of the Data Subjects
  • Data Controller Responsiblity
  • Data Processors and Subprocessors
  • Security of Processing and Data Protection By Design
  • Management of Data Breaches
  • Data Protection Impact Assessment (DPIA)
  • Data Protection Officer (DPO)
  • Transfer of personal data to third countries or international organisations (if applicable)

 

C – Complementary Checks and Controls: The Core Criteria are completed by Complementary Checks and Controls, to assess compliance with domain-specific and technology-specific obligations that may apply to the Target of Evaluation.

T – Technical and Organisational Measures: The Technical and Organisational Measures Checks and Controls aim at assessing the adequacy of the measures in place to secure the processed data. Except for high-risk data processing, it can be replaced by a valid ISO/IEC 27001 certificate encompassing the target of Evaluation.

S – Surveillance Audits Checklist: A few additional criteria are specified for the surveillance audits to assess and ensure continuous compliance over time.

 

N – National Obligations: Europrivacy supports compliance assessment with complementary national obligations through various instruments:

  • National obligation profiles for each one of the European Economic Area Member States. These resources can be used to prepare a National Obligation Compliance Assessment Report (NOCAR).
  • Europrivacy national criteria extension to assess and certify compliance of a Target of Evaluation with complementary national regulations on data protection. These extensions are optional and used on a voluntary basis to extend a Europrivacy certification towards the corresponding non-EU jurisdiction(s).
  • Potential Conflict of Law Analysis to assess if the national law applicable to the Applicant in third countries would prevent it to comply with the GDPR and certification requirements.