GDPR-CARPA under GDPR Art. 46(2)(f)

An approved national Article 42 scheme, adopted by the Luxembourg supervisory authority, but not approved as a transfer tool under Article 46(2)(f).

Invalidation trigger

The Board approves the GDPR-CARPA criteria for use as a transfer tool.

Sources

1. [1]EDPB Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR-CARPA certification criteria, section 2.1, "not a certification according to article 46(2)(f) of the GDPR" · retrieved 2026-09-17 · https://www.edpb.europa.eu/system/files/documents/2022-02/opinion_01-2022_gdpr-carpa_certification_criteria_en.pdf
2. [2]CNPD, The certification scheme GDPR-CARPA, criteria adopted by the CNPD on 13 May 2022 · retrieved 2026-09-17 · https://cnpd.public.lu/en/professionnels/outils-conformite/certification/gdpr-carpa.html
3. [3]EDPB register of certification mechanisms, seals and marks (filtered on certification as tool for transfers), GDPR-CARPA (LU) listed; not among certifications usable as a tool for transfers · retrieved 2026-09-17 · https://www.edpb.europa.eu/registers/register-of-consistency-and-of-accountability-tools/certification-mechanisms-and-data_en

Confidence

high

Jurisdiction

European Union · coverage drafting

Permanent URL

/effect/european-union/gdpr-46-2-f/gdpr-carpa