Cybersecurity Policy Report, Norwegian DPA Updates Guidance on GDPR Certifying Bodies, (Jun 25, 2024)
By Tony Foley
Datatilsynet, the Norwegian data protection authority, has published additional requirements that businesses seeking to obtain accreditation to offer privacy certifications must meet to satisfy necessary criteria developed by either the agency or the European Data Protection Board (EDPB).
In a June 20 news release, Datatilsynet said any business wishing to offer certifications must first be accredited by Norwegian Accreditation and comply with Datatilsynet’s requirements. Those requirements are based on article 43 of the European Union’s General Data Protection Regulation (GDPR) as well as EDPB Guidelines 4/2018 on the accreditation of certification bodies.
Datatilsynet’s requirements provide that a business seeking accreditation as a certification body must demonstrate compliance with all legal requirements under the GDPR and must demonstrate that its certification agreements contain specified provisions, including requiring applicants to comply with the general certification requirements, allowing full transparency to Datatilsynet with respect to the certification procedure, specifying that the responsibility of an applicant to comply with the GDPR may not be reduced, and requiring applicants to comply with all deadlines and procedures, among other elements.
The requirements also contain information regarding the management of impartiality as a certification body, a demonstration by a certification body that it has appropriate measures in place to cover liabilities, and a requirement that the certification body’s criteria are published and readily publicly available.
News: InternationalLegislation DataPrivacy GDPR