Europrivacy under GDPR Art. 42

Approved by the EDPB as the first certification mechanism usable as a transfer tool under Articles 42 and 46 (Opinion 15/2026). Opinion 14/2026 also extended the criteria to controllers and processors outside the EEA that are subject to Article 3(2).

Invalidation trigger

The EDPB withdraws or amends Opinion 15/2026, or the certificate is withdrawn or lapses (maximum validity three years).

Sources

1. [1]EDPB Opinion 15/2026 on the Europrivacy certification criteria as European Data Protection Seal to be used as tool for transfers, paras 20, 25 and 53 · retrieved 2026-09-17 · https://www.edpb.europa.eu/system/files/2026-04/edpb_opinion_202615_europrivacy_en.pdf
2. [2]EDPB Opinion 14/2026 on the Europrivacy certification criteria as European Data Protection Seal, paras 27 and 54 · retrieved 2026-09-17 · https://www.edpb.europa.eu/system/files/2026-05/edpb_opinion_202614_europrivacy_en.pdf
3. [3]EDPB register of certification mechanisms, seals and marks (filtered on certification as tool for transfers), 1 item, Europrivacy Certification Scheme Extension for Certifying Data Importers under Article 46 · retrieved 2026-09-17 · https://www.edpb.europa.eu/registers/register-of-consistency-and-of-accountability-tools/certification-mechanisms-and-data_en
4. [4]Regulation (EU) 2016/679 (GDPR), Art. 42(2), (5) and (7) · retrieved 2026-09-17 · https://eur-lex.europa.eu/eli/reg/2016/679/oj

Confidence

high

Jurisdiction

European Union · coverage drafting

Permanent URL

/effect/european-union/gdpr-42/europrivacy