> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/mica.wtf/gdpr/chapter-iv-controller-and-processor-art.-24-43/42.md). # Art. 42 — Certification 1. The Member States, the supervisory authorities, the Board and the Commission shall encourage, in particular at Union level, the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance with this Regulation of [processing](https://headlesslaw.com/definitions/gdpr/processing/) operations by controllers and processors. The specific needs of micro, small and medium-sized enterprises shall be taken into account. 2. In addition to adherence by controllers or processors subject to this Regulation, data protection certification mechanisms, seals or marks approved pursuant to paragraph 5 of this Article may be established for the purpose of demonstrating the existence of appropriate safeguards provided by controllers or processors that are not subject to this Regulation pursuant to [Article 3](/mica.wtf/gdpr/chapter-i-general-provisions-art.-1-4/3.md) within the framework of [personal data](https://headlesslaw.com/definitions/gdpr/personal-data/) transfers to third countries or international organisations under the terms referred to in point (f) of [Article 46(2)](/mica.wtf/gdpr/chapter-v-transfers-of-personal-data-to-third-countries-or-international-organisations-art.-44-50/46.md). Such controllers or processors shall make binding and enforceable commitments, via contractual or other legally binding instruments, to apply those appropriate safeguards, including with regard to the rights of data subjects. 3. The certification shall be voluntary and available via a process that is transparent. 4. A certification pursuant to this Article does not reduce the responsibility of the [controller](https://headlesslaw.com/definitions/gdpr/controller/) or the [processor](https://headlesslaw.com/definitions/gdpr/processor/) for compliance with this Regulation and is without prejudice to the tasks and powers of the supervisory authorities which are competent pursuant to [Article 55](/mica.wtf/gdpr/chapter-vi-independent-supervisory-authorities-art.-51-59/55.md) or [56](/mica.wtf/gdpr/chapter-vi-independent-supervisory-authorities-art.-51-59/56.md). 5. A certification pursuant to this Article shall be issued by the certification bodies referred to in [Article 43](/mica.wtf/gdpr/chapter-iv-controller-and-processor-art.-24-43/43.md) or by the competent [supervisory authority](https://headlesslaw.com/definitions/gdpr/supervisory-authority/), on the basis of criteria approved by that competent supervisory authority pursuant to [Article 58(3)](/mica.wtf/gdpr/chapter-vi-independent-supervisory-authorities-art.-51-59/58.md) or by the Board pursuant to [Article 63](/mica.wtf/gdpr/chapter-vii-cooperation-and-consistency-art.-60-76/63.md). Where the criteria are approved by the Board, this may result in a common certification, the European Data Protection Seal. 6. The controller or processor which submits its processing to the certification mechanism shall provide the certification body referred to in [Article 43](/mica.wtf/gdpr/chapter-iv-controller-and-processor-art.-24-43/43.md), or where applicable, the competent supervisory authority, with all information and access to its processing activities which are necessary to conduct the certification procedure. 7. Certification shall be issued to a controller or processor for a maximum period of three years and may be renewed, under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in [Article 43](/mica.wtf/gdpr/chapter-iv-controller-and-processor-art.-24-43/43.md) or by the competent supervisory authority where the criteria for the certification are not or are no longer met. 8. The Board shall collate all certification mechanisms and data protection seals and marks in a register and shall make them publicly available by any appropriate means. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/mica.wtf/gdpr/chapter-iv-controller-and-processor-art.-24-43/42.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.