UK GDPRUK · retained 2016/679
Digiphile
Regulation (EU) 2016/679 as retained in UK law (UK GDPR) – Article 42 – Certification

Articles

Article 42Certification

1. [F1The [F2Commission]] shall encourage F3... the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance with this Regulation of processing operations by controllers and processors. The specific needs of micro, small and medium-sized enterprises shall be taken into account.
2. In addition to adherence by controllers or processors subject to this Regulation, data protection certification mechanisms, seals or marks approved pursuant to paragraph 5 of this Article may be established for the purpose of demonstrating the existence of F4... safeguards provided by controllers or processors that are not subject to this Regulation pursuant to Article 3 within the framework of personal data transfers to third countries or international organisations under the terms referred to in point (f) of Article 46(2). Such controllers or processors shall make binding and enforceable commitments, via contractual or other legally binding instruments, to apply those F4... safeguards, including with regard to the rights of data subjects.
3. The certification shall be voluntary and available via a process that is transparent.
4. A certification pursuant to this Article does not reduce the responsibility of the controller or the processor for compliance with this Regulation and is without prejudice to the tasks and powers of [F5the [F6Commission]].
5. A certification pursuant to this Article shall be issued by the certification bodies referred to in Article 43 or by [F7the [F6Commission]], on the basis of criteria approved by [F8the [F6Commission]] pursuant to Article 58(3) F9... . Where the criteria are approved by the Board, this may result in a common certification, the European Data Protection Seal.
6. The controller or processor which submits its processing to the certification mechanism shall provide the certification body referred to in Article 43, or where applicable, [F10the [F6Commission]], with all information and access to its processing activities which are necessary to conduct the certification procedure.
7. [X1 Certification shall be issued to a controller or processor for a maximum period of three years and may be renewed, under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by [F11the [F6Commission]] where the criteria for the certification are not or are no longer met.]
8. [F12The [F6Commission]] shall collate all certification mechanisms and data protection seals and marks in a register and shall make them publicly available by any appropriate means.

Amended text

This Article is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations and footnotes

Textual Amendments

  1. F1 Words in Art. 42(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 36(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F2 Word in Art. 42(1) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(q); S.I. 2026/1015, reg. 2(c)
  3. F3 Words in Art. 42(1) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 36(2)(b) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)
  4. F4 Words in Art. 42(2) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 6 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
  5. F5 Words in Art. 42(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 36(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  6. F6 Word in Art. 42(4)-(8) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(q); S.I. 2026/1015, reg. 2(c)
  7. F7 Words in Art. 42(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 36(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  8. F8 Words in Art. 42(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 36(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  9. F9 Words in Art. 42(5) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 36(4)(c) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)
  10. F10 Words in Art. 42(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 36(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  11. F11 Words in Art. 42(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 36(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  12. F12 Words in Art. 42(8) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 36(7) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Editorial Information

  1. X1 Substituted by Corrigendum to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the European Union L 119 of 4 May 2016).

Related recitals

Rec. 100

https://uk-gdpr.digiphile.law/article/article-42.html

Text as at 17 September 2026.

This is an unofficial convenience version of the UK GDPR (Regulation (EU) 2016/679 as retained in UK law). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.