Article 42. Certification

(1) The Centre shall encourage the establishment of certification mechanisms in the field of personal data protection, as well as of seals and marks in that field, for the purpose of demonstrating that processing operations carried out by controllers and processors comply with this Law. The specific needs of micro, small and medium-sized enterprises shall be taken into account.

(2) Certification mechanisms, seals or marks in the field of personal data protection approved pursuant to paragraph (5) shall be established not only to be complied with by controllers or processors subject to this Law, but also for the purpose of demonstrating the existence of appropriate safeguards provided by controllers or processors that are not subject to this Law pursuant to art. 3, within the framework of transfers of personal data to other states or to international organisations under the conditions of art. 46(2)(e). Such controllers or processors shall make binding and enforceable commitments, via contractual instruments or other binding legal acts, for the purpose of applying those appropriate safeguards, including with regard to the rights of data subjects.

(3) The certification shall be voluntary and available via a transparent process.

(4) A certification pursuant to this Article shall not reduce the responsibility of the controller or the processor for compliance with this Law and shall be without prejudice to the tasks and powers of the Centre.

(5) The certification bodies referred to in art. 43 or the Centre shall grant a certification pursuant to this Article on the basis of the certification criteria approved by the Centre.

(6) The controller or processor which submits its processing activities to the certification mechanism shall provide the certification body or, where applicable, the Centre with all the information necessary to conduct the certification procedure, as well as access to the processing activities concerned.

(7) Certification shall be granted to a controller or processor for a maximum period of three years and may be renewed under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn by the certification bodies or, where applicable, by the Centre where the criteria for the certification are no longer met.

(8) The Centre shall keep a register of certification mechanisms and of personal data protection seals and marks and shall publish them on its official website.