ISO/IEC 27701 under GDPR Art. 42

Not a GDPR certification. Criteria published by an ISO technical committee have not been approved under Article 58(3) or Article 63; the defect is one of authority, not of substance.

Invalidation trigger

Criteria based on the scheme are approved by a supervisory authority under Article 58(3) or by the Board under Article 63.

Sources

1. [1]Regulation (EU) 2016/679 (GDPR), Art. 42(5) · retrieved 2026-09-17 · https://eur-lex.europa.eu/eli/reg/2016/679/oj
2. [2]EDPB register of certification mechanisms, seals and marks, no ISO/IEC 27701-based criteria among the 17 entries · retrieved 2026-09-17 · https://www.edpb.europa.eu/registers/register-of-consistency-and-of-accountability-tools/certification-mechanisms-and-data_en

Confidence

medium

Jurisdiction

European Union · coverage drafting

Permanent URL

/effect/european-union/gdpr-42/iso-27701