Recital 100
General Data Protection Regulation · UE 2016/679
| (100) | In order to enhance transparency and compliance with this Regulation, the establishment of certification mechanisms and data protection seals and marks should be encouraged, allowing data subjects to quickly assess the level of data protection of relevant products and services. |
In Luxembourg, the CNPD developed GDPR-CARPA (Certified Assurance Report based Processing Activities), the first article 42 certification scheme approved in the EU in May 2022. It applies to a processing operation or a set thereof and is delivered by certification bodies accredited by OLAS under ISO/IEC 17065. Claiming 'CNPD certified' without holding a valid GDPR-CARPA certificate is therefore a misleading claim under recital 100 and article 42(5).
Luxgap practice: we systematically verify that any GDPR-CARPA mention on a Luxembourg website or tender refers to a real certificate, whose scope actually covers the relevant processing and whose validity (maximum three years) has not expired.
