Legal gateway

General Data Protection RegulationRegulation (EU) 2016/679European UnionCoverage drafting

1. 001EuroprivacyGDPR Art. 42TIER 05Approved by the EDPB as the first certification mechanism usable as a transfer tool under Articles 42 and 46 (Opinion 15/2026). Opinion 14/2026 also extended the criteria to controllers and processors outside the EEA that are subject to Article 3(2).+

   Invalidation trigger

   The EDPB withdraws or amends Opinion 15/2026, or the certificate is withdrawn or lapses (maximum validity three years).

   Sources

   1. [1]EDPB Opinion 15/2026 on the Europrivacy certification criteria as European Data Protection Seal to be used as tool for transfers, paras 20, 25 and 53 · retrieved 2026-09-17 · https://www.edpb.europa.eu/system/files/2026-04/edpb_opinion_202615_europrivacy_en.pdf
   2. [2]EDPB Opinion 14/2026 on the Europrivacy certification criteria as European Data Protection Seal, paras 27 and 54 · retrieved 2026-09-17 · https://www.edpb.europa.eu/system/files/2026-05/edpb_opinion_202614_europrivacy_en.pdf
   3. [3]EDPB register of certification mechanisms, seals and marks (filtered on certification as tool for transfers), 1 item, Europrivacy Certification Scheme Extension for Certifying Data Importers under Article 46 · retrieved 2026-09-17 · https://www.edpb.europa.eu/registers/register-of-consistency-and-of-accountability-tools/certification-mechanisms-and-data_en
   4. [4]Regulation (EU) 2016/679 (GDPR), Art. 42(2), (5) and (7) · retrieved 2026-09-17 · https://eur-lex.europa.eu/eli/reg/2016/679/oj

   VERIFIED 2026-09-17 · REVIEW BY 2027-03-16

   Permalink /effect/european-union/gdpr-42/europrivacy
2. 002EuroprivacyGDPR Art. 46(2)(f)TIER 05An approved Article 42 certification, together with binding and enforceable commitments of the importer, is an appropriate safeguard for transfers. Europrivacy's criteria are the only ones approved for that purpose (Opinion 15/2026).+

   Invalidation trigger

   The EDPB withdraws or amends Opinion 15/2026, the certificate is withdrawn or lapses, or the importer's binding and enforceable commitments are absent.

   Sources

   1. [1]Regulation (EU) 2016/679 (GDPR), Art. 46(2)(f) · retrieved 2026-09-17 · https://eur-lex.europa.eu/eli/reg/2016/679/oj
   2. [2]EDPB Opinion 15/2026 on the Europrivacy certification criteria as European Data Protection Seal to be used as tool for transfers, paras 25, 52 and 53 · retrieved 2026-09-17 · https://www.edpb.europa.eu/system/files/2026-04/edpb_opinion_202615_europrivacy_en.pdf
   3. [3]EDPB register of certification mechanisms, seals and marks (filtered on certification as tool for transfers), 1 item, Europrivacy Certification Scheme Extension for Certifying Data Importers under Article 46 · retrieved 2026-09-17 · https://www.edpb.europa.eu/registers/register-of-consistency-and-of-accountability-tools/certification-mechanisms-and-data_en

   VERIFIED 2026-09-17 · REVIEW BY 2027-03-16

   Permalink /effect/european-union/gdpr-46-2-f/europrivacy