Europrivacy™/® Certification

The General Data Protection Regulation (GDPR) applies to all businesses processing personal data linked to European citizens, regardless of where the business is based. It asserts the individual’s right to control their personal data through consent and requires businesses to comply with a range of obligations.

It sets out seven key principles:

1. Lawfulness, fairness and transparency
2. Purpose limitation
3. Data minimization
4. Accuracy
5. Storage limitation
6. Integrity and confidentiality
7. Accountability

These principles should lie at the heart of your approach to processing personal data.

Noncompliance can result in fines of up to 4% of global annual turnover or EUR 20 million, whichever is greater.

Since the GDPR came into force in 2018, hundreds of millions of euros worth of fines have been handed out by information commissioners for offenses, including retailers misrepresenting the way they use CCTV cameras to monitor employees and noncompliance with the “right to be forgotten” law.

The Europrivacy certification scheme was researched and developed through Horizon 2020, a European research program, to assess, document, certify and value compliance with the GDPR and complementary data protection regulations.

It is managed by the European Centre for Certification and Privacy (ECCP) and maintained by the Europrivacy International Board of Experts in data protection, with the support of partners.

Europrivacy is based on ISO/IEC 17065 (requirements for bodies certifying products, processes and services) and GDPR Article 42 – “for the purpose of demonstrating compliance with this regulation of processing operations by controllers and processors.”

Europrivacy is continuously updated by the ECCP and International Board of Experts. It is licensed to qualified certification bodies, such as SGS, and consulting firms committed to protecting personal data.

The initiative is for data controllers and processors, and can be used anywhere to assess a product, an online solution or internal process’s compliance with the GDPR. However, delivering certificates does not apply to jurisdictions that do not provide adequate guarantees for the rights and freedoms of data subjects.

Europrivacy is supported by a network of qualified partners, an online academy, a community website and web-based tools.

Europrivacy is an international trademark registered in several jurisdictions.

• Recognized in all EU member states (Article 42 GDPR)
• Hybrid – applies to almost all data processing activities, including emerging technologies like artificial intelligence (AI), blockchain and the Internet of Things (IoT)
• Compatible with ISO/IEC 17065 (requirements for bodies certifying products, processes and services)
• Combines with ISO/IEC 27001 (information security management systems) and ISO/IEC 27701 (privacy information management systems, or PIMS)
• Continuously updated to align with the latest regulations and jurisprudence
• Step-by-step certification – compliance can be progressively certified
• Extendable to complement national data protection regulations, including non-EU and domain- and technology-specific regulations
• Independent and managed by experts
• A global ecosystem comprising qualified partners and experts, including SGS
• Reinforced by dedicated research and innovation to keep up to date