Protecting personal data through accreditation for the Europrivacy™/® scheme
Accredia has launched an accreditation process in Italy for the issuance of certifications under the Europrivacy™/® scheme—a scheme approved by the European Data Protection Board as a “European Data Protection Seal” under the GDPR and positively evaluated by European Accreditation.
Operating in compliance with both European and national regulations is becoming increasingly critical, particularly in the field of personal data protection. In this context, Accredia has recently renewed its Agreement with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali – GPDP). This renewed partnership strengthens the commitment to information exchange and collaboration, ensuring the reliability of certifications issued in accordance with EU Regulation 2016/679—the General Data Protection Regulation (GDPR).
The first scheme compliant with the EU GDPR
The role of accreditation and accredited certification has recently been affirmed at the European level, following the approval of the Europrivacy™/® scheme as a “European Data Protection Seal” by the European Data Protection Board (EDPB) and its subsequent recognition by the European co-operation for Accreditation (EA).
Specifically, the scheme has been deemed suitable for the accreditation of certification bodies in accordance with EU Regulation 2016/679 (GDPR).
As Emanuele Riva, Vice Director General of Accredia and Chair of IAF, explains: “Today, eight years after the publication of EU Regulation 2016/679, we can finally fully implement Article 43 of this Regulation.”
The GDPR promotes the use of accredited certification for personal data protection—including seals and marks—to attest that data processing activities carried out by controllers and processors are compliant. Article 43 stipulates that certification bodies must be accredited by the competent supervisory authority or by the national accreditation body—Accredia, in the case of Italy—or both.
This formal recognition—as detailed in Technical circular DC N° 12/2024, titled “Provisions regarding accreditation for the Europrivacy™/® certification scheme (within the scope of product/service certification)”—launches the certification process. Such certification must be issued by bodies accredited in accordance with the standard UNI EN ISO/IEC 17065:2012.
Accredited certification for companies
Approved by the European Data Protection Board (EDPB) for assessing and certifying the compliance of all types of data processing—in accordance with the GDPR and complementary national data protection regulations—the Europrivacy™/® scheme enables accredited bodies to certify companies and organizations. This process helps them identify and mitigate risks in this area.
Furthermore, it allows them to showcase their compliance through the only GDPR certification officially recognized across all EU Member States.
For companies, this process can foster trust, leading to competitive advantages in terms of reputation and market access.
Moreover, for the benefit of citizens, these accredited bodies help ensure a process that reduces risks to their personal data.
Accreditation process for Certification Bodies
As explained in Technical circular DC N° 12/2024, certifications under the Europrivacy™/® scheme must be issued by bodies accredited in accordance with the requirements of the UNI EN ISO/IEC 17065:2012 standard, as well as any other applicable requirements.
The applicant body must comply with:
- Accredia General Regulations RG-01 and RG-01-03.
Depending on the accreditations already held, the body will undergo a specific number of assessment days, categorized into three scenarios:
Body accredited according to UNI CEI EN ISO/IEC 17065:2012:
- 1 day for document review (to be conducted, at least in part, via synchronous remote means)
- 2 days for on-site assessment, plus 1 day for reporting
- 1 witnessed assessment (on-site observation) of sufficient duration to cover the key elements of the audit process conducted by the body.
Body accredited for schemes other than UNI CEI EN ISO/IEC 17065:2012:
- 1 day for document review (to be conducted, at least in part, via synchronous remote means
- 3 days for on-site assessment, plus 1 day for reporting
- 1 witnessed assessment (on-site observation) of sufficient duration to cover the key elements of the audit process conducted by the body.
Body not accredited under any scheme:
- 1 day for document review (to be conducted, at least in part, via synchronous remote means)
- 4 days for on-site assessment, plus 1 day for reporting
- 1 witnessed assessment (on-site observation) of sufficient duration to cover the key elements of the audit process conducted by the body.
Given the high complexity of the scheme, the number of audit days required to maintain accreditation varies according to the number of certificates issued by the body, in line with the detailed provisions set out in the Technical circular.
DETAILS PAGE
Products and services certification bodies
The product certification body is responsible for verifying product conformity to the certification requirements, voluntary technical standards, or other regulatory frameworks.