Industry certificates of data processing compliance

The certification process checks the compliance of data processing operations with the certification criteria approved by the supervisory authority. 

The additional requirements for accreditation of certification bodies have been signed after positive feedback from the European Data Protection Board. The document has been developed on the basis of Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of the General Data Protection Regulation (2016/679).

Certification in Poland will be done by certification bodies accredited by the Polish Accreditation Centre (PAC). The accreditation will be done pursuant to ISO/IEC 17065/2012 and the additional requirements for accreditation of certification bodies just approved by the President of the Personal Data Protection Office.

The Personal Data Protection Office has stated that the applicants will be allowed to develop the certification mechanisms, including the certification criteria, to account for their industry specificity.

 Universal data protection standards are not always sufficient. Guidance that accounts for industry specificity is often needed. Such detailed criteria verified by a certification body may help protect personal data better, which is the ultimate goal.

Pursuant to Article 12(1) of the Polish Personal Data Protection Act of 10 May 2018, bodies that seek data protection certification rights referred to in Article 43 GDPR will be accredited by the Polish Accreditation Centre. Accreditation will be granted according to the rules set out in Article 43(1)–(7) GDPR. 

The approval and publication of the additional requirements for accreditation of certification bodies does not mean that those seeking certification may right away apply to the PAC for the accreditation referred to in the General Data Protection Regulation. First, the market has to create certification mechanisms, including the certification criteria referred to in Article 42(5) GDPR because accreditation will follow a specific certification mechanism.