GDPR Art.43: Certification Bodies

Before engaging any certification body, verify their accreditation status directly with the relevant supervisory authority or national accreditation body. Confirm they are accredited for the specific GDPR certification scheme you want and that they have relevant expertise in your processing context. Check their track record and ask for references from other certified organisations. Get clear on the assessment methodology before you sign anything. Review their published criteria, the assessment process, typical timelines, and what they expect from you. Pin down the certification scope, the evidence they need, the assessment format (document review, on-site audit, remote assessment), and the qualifications of the people who will conduct the evaluation. Prepare properly. Organise documentation, brief responsible staff on the process and their roles, run internal pre-assessments, and close any known gaps. When the assessment begins, provide requested information quickly and facilitate access to systems, staff, and premises without friction. Keep the relationship alive between assessments. Report any significant changes to your processing that could affect your certification status. Engage with surveillance audits proactively and respond to findings without delay. Flag any concerns about maintaining compliance early rather than waiting for the next formal review. If you are looking to establish a new certification scheme for your sector, talk to the supervisory authority early about the approval process. Design robust assessment criteria, recruit qualified assessors, and build a scheme that delivers genuine compliance assurance rather than a superficial review.