GDPR · Personal data protectionLegal obligation

GDPR: an obligation for everyone, a certification only for processing.

The GDPR applies to anyone who processes personal data. There is no company-wide “GDPR certification”: Article 42 provides for voluntary certifications of processing operations, with approved schemes. Europrivacy was the first European seal approved by the EDPB, and in Italy Accredia accredits the bodies that certify it.

Join the list for GDPR All standards

What it is

Data processed on a legal basis, protected, and rights respected.

The GDPR sets the rules for processing personal data: principles, legal bases, data subjects’ rights, security, transfers outside the Union. A certification under Article 42 covers processing operations, not the company as a whole, and does not reduce the controller’s responsibility.

Who needs it

Anyone who processes personal data of customers, employees or patients
Those who process data on behalf of others, as processors
Those who want to demonstrate a processing operation with an approved certification
Those who have ISO/IEC 27001 and want to know what it covers and what it doesn’t

What it requires, and what you risk

Fines of up to 20 million euros or 4% of annual worldwide turnover, whichever is higher, for principles, legal bases, rights and transfers; up to 10 million or 2% for the other obligations.
Reg. (UE) 2016/679, art. 83(4) and 83(5)
An approved certification can help the controller demonstrate compliance with its obligations, and the authority takes it into account when deciding on a fine.
Reg. (UE) 2016/679, art. 24(3) and art. 83(2)(j)
Europrivacy was the first European seal approved by the EDPB; in Italy, Accredia accredits the bodies that certify it.
EDPB, Opinion 28/2022; Accredia, Europrivacy

The path

What you need to do, in order.

1
Map the processing
Which data, whose, for what purpose, on which legal basis and for how long.
2
Security measures
Technical and organisational measures appropriate to the risk, and impact assessments where needed.
3
Rights and breaches
Timely replies to data subjects, and data breaches notified to the Garante within 72 hours when required.
4
Certification, if you want it
For individual processing operations, with a scheme approved under Article 42 and an accredited body. It lasts three years at most.

10ISO

How 10ISO will help you

The agents will do the work that repeats itself; decisions stay with you and whoever supports you. 10ISO is coming soon: this is what we’re building.

Record of processing, appointments and impact assessments: they will come with 10DPO, the 10Safety expansion for data protectionComing soon
Evidence shared with ISO/IEC 27001, uploaded onceComing soon
Data breaches recorded with their notification timesComing soon
The path to an Article 42 certification, one processing operation at a timeComing soon

Read alongside

Questions

The first questions people ask about GDPR.

Is there a company-wide “GDPR certification”?

No: processing operations are certified, with schemes approved under Article 42. Europrivacy was the first European seal approved by the EDPB, and in Italy Accredia accredits the bodies that certify it.

If I’m certified, do I avoid fines?

No: certification does not reduce the controller’s responsibility. The authority does, however, take it into account when deciding the amount of a fine.

It is a scheme accredited by Accredia, but as of 28/09/2026 it does not appear in the EDPB register of mechanisms approved under Article 42, so it does not carry that value.

Sources

Every reference on this fact sheet comes from one of these sources, checked on 28/09/2026. If a law or a standard changes, the fact sheet is updated.

Waiting list

We’ll write to you when 10ISO opens.

One minute: who you are, your email and the standard you’re interested in. It’s not a subscription and we don’t ask for a card.