Member States, supervisory authorities, the Board and the Commission shall encourage at Union level the establishment of data protection certification mechanisms and of data protection seals and marks to demonstrate compliance by controllers and processors with this Regulation, with specific needs of micro, small and medium-sized enterprises to be taken into account. Certification may also be established for controllers or processors not subject to the Regulation to demonstrate appropriate safeguards for personal data transfers to third countries or international organisations under Article 46(2)(f), provided they make binding and enforceable commitments, including in respect of the rights of data subjects.

Certification is voluntary, transparent and does not reduce the responsibility of controllers or processors nor affect the tasks and powers of supervisory authorities under Articles 55 and 56. Certifications are issued by the Article 43 certification bodies or by the competent supervisory authority against criteria approved under Article 58(3) or by the Board under Article 63; Board approval may produce a common European Data Protection Seal. Controllers and processors must supply necessary information and access. Certifications last up to three years, may be renewed, can be withdrawn if criteria are not met, and the Board will register and publish all mechanisms, seals and marks.