Public Consultation – GDPR Certification of Data Processors

The CNIL encourages stakeholders to consolidate their comments, when possible, into a single contribution by pooling different internal feedback or by working with their federation.

Contributions submitted to the CNIL in this context are not public, and their confidentiality will be ensured. These may be summarized and presented as part of any public consultation synthesis published by the CNIL after its completion. These summaries or syntheses will not contain any personal information regarding the identity of respondents or the organization to which the respondent belongs.

It should be noted, however, that contributions could be subject to an access request as administrative documents (code of relations between the public and administration). In your contribution, indicate any elements protected by literary or artistic property rights (specify, in this case, whether or not you allow their communication), or by trade secrets. Note that CNIL is not bound to follow your assessment of what is protected or not.

Introduction

The following questions aim to identify your main expectations for a processor certification and to adjust the level of protection required to access it.

More detailed feedback, focusing on one or multiple criteria of the reference framework, will also allow CNIL to adapt its project more specifically. In expressing your expectations, certain inherent limitations of certification should be considered.

In particular, it should be emphasized that the evaluation carried out to certify an “turnkey or off-the-shelf” service is not exhaustive: it is generally not conducted in the context of each processor's client. Indeed, depending on the number of processor's clients, the certification body may need to conduct its verifications through sampling, for example by selecting a limited number of clients to verify compliance with a criterion.

Thus, certification is not a suitable tool for guaranteeing the controller's implementation of any negotiated contractual clauses or specific instructions in the context of its processing, beyond those explicitly listed by the criteria.

This certification is also not intended to establish the processor's compliance with obligations incumbent upon its clients (controllers) or its further sub-processors. Furthermore, the proposed certification does not constitute a transfer tool for implementing transfers outside the European Union with appropriate guarantees under Article 46 of the GDPR.

Contact information

First and last name

Email

Organization name

Your organization is located in :

France

European union

Outside EU

The following questions are based on detailed points in the draft evaluation scheme submitted to consultation.

► Consult the draft (in French)

Q4: Do you have any general comments on the GDPR certification project under consultation?

CNIL: search form

Public Consultation – GDPR Certification of Data Processors