Certification Journey for Auditors

Welcome to Europrivacy! Here is a step-by-step journey to support the certification of a data processing activity by a Certification Body. As an Auditor, you are expected to have successfully completed the online course for Auditors on the Europrivacy Online Academy.

  1. Start with an overview of the process by reading the Europrivacy Guidelines for Applicant. You can also attend the Introductory course on the Europrivacy Online Academy.
  2. Select a data processing activity and specify the corresponding Target of Evaluation (ToE) with the Europrivacy Certification Application Form. If further support and guidance on how to select and specify the ToE are needed, please consult the Europrivacy Guidelines on Specifying the Target of Evaluation.
  3. Check and validate the Target of Evaluation with the A – Application & ToE Checklist to be sure that it complies with the EDPB requirements.
  4. Gather and prepare the required documentation with the help of the D – Documentation Checklist. You can save time with the following resources:
    • P - Policy and Procedure Checklist to check in advance whether the policies and procedures in place are sufficient.
    • DPO's statement template to be filled by the DPO.
    • NOCAR template and the National obligations profiles per country to prepare the National Obligations Conformity Assessment Report, ensuring that you are not breaching national obligations.
  5. Document the compliance of your Target of Evaluation with the Europrivacy criteria:
    • G – GDPR Core Criteria to assess compliance with the core GDPR requirements.
    • C – Complementary Contextual checks and controls to assess compliance with the domain- and technology-specific requirements.
    • T – Technical & Organisational checks and controls to assess the security measures in place to protect the processed data (except if you have an active ISO/IEC 27001 certification and the ToE is not a high-risk data processing).

    You can refer to the Europrivacy Guidelines on the Use of Criteria, Checks and Controls for further support.

  6. Request offers and select a certification body from the list of official partners. Your certification body will audit your Target of Evaluation and, if adequate, it will deliver a certificate of compliance that will be published on the official Europrivacy registry.
  7. Once certified, maintain your compliance and enjoy Europrivacy! See the Europrivacy Guidelines on Valuing and Communicating Certification for more information.

You can find many more resources and tools in the Europrivacy Community, including in the Document Library.