Luxembourg is the first country to implement a GDPR compliance certificate.
Luxembourg’s National Commission for Data Protection (CNPD) is developing certification criteria for EU General Data Protection Regulation Certified Assurance Report-based Processing Activities. According to the CNPD, the program verifies a company’s processing processes and provides;
“data controllers and subcontractors with a high level of GDPR compliance.”
The CNPD stated that certification encourages openness and compliance and allows data subjects to
“better assess the level of data protection given by the products, services, processes, or systems of organizations that process their personal data.”
On May 13, 2022, CNPD adopted its GDPR-CARPA certification system. GDPR-CARPA is the first national and international certification system established under the GDPR (General Data Protection Regulation).
Who can use the GDPR compliance certificate?
Companies, public bodies, groups, and other organizations based in Luxembourg can now certify that their data processing activities conform with the GDPR.
GDPR-CARPA provides controllers and processors with a high level of regulatory compliance for the data processing activities covered by the certification.
Rather than the company itself, the GDPR compliance certificate mechanism verifies certain processing methods (e.g., products, services, processes, or systems used or offered by the organizations).
The CNPD approves organizations that will offer GDPR certificates.
The CNPD certification method is distinguished by the fact that it is based on an ISAE 3000 Type 2 report, which provides for the release of an opinion on the correct execution of the control mechanism while holding the auditor formally accountable.
This contributes to a high level of trust in the certification scheme’s unique processing activity.
