Guidelines 07/2022 on certification as a tool for transfers

What it covers

This document explains how certification under Articles 42 and 43 GDPR can be used as an appropriate safeguard for international transfers under Article 46(2)(f). It sets out the roles of exporters, importers and certification bodies, additional certification criteria specific to transfers, and the content of binding and enforceable commitments, with an annex of supplementary measures.

Why it matters

It is the reference document for organisations and certification bodies considering certification as an alternative to standard contractual clauses or BCRs for transferring personal data outside the EEA.

Refer to it when

• assessing certification as a transfer mechanism
• designing certification criteria covering third-country transfers
• drafting binding and enforceable commitments for an importer
• advising a certification body on accreditation requirements for transfers

Questions this document addresses

• What role does certification play under Article 46(2)(f) GDPR?
• What additional criteria must a certification scheme include to cover transfers?
• What must binding and enforceable commitments by an importer contain?
• How does certification interact with accreditation requirements under Article 43?

Topics

• International transfers
• Certification & accreditation
• Controller & processor