How to assess a privacy certification in an IT contract: certified processing, accredited body, approved criteria and limits of the evidence.
Mag. Bernhard Brandauer, Austrian attorney-at-law
BRANDAUER Rechtsanwälte
Mag. Bernhard Brandauer advises businesses on the legal classification and practical implementation of data protection requirements.
A privacy certification mark confirms a defined certified processing activity involving personal data. The IT contract must therefore show which processing was assessed, which components the criteria covered and which accredited body issued the certification. A seal alone does not turn a software product into a general privacy approval.
The contract review focuses on the link between certificate, purchased service and actual use. The organisation compares the certified subject matter with data flows, configuration, locations and roles. This shows which part of the provider information the evidence covers and which checks remain open.
Answer the questions for the specific provider and processing activity. The result indicates which documents to compare first.
Look for personal data, purpose, service and assessed components.
Request a description of the specific processing activity. A product name, platform label or general security statement does not show which personal data and components were assessed.
Request the complete evidence and the issuing certification body. Check whether the body is accredited for privacy certifications and whether the provider supplies the body’s actual certification record.
Check which approved criteria support the certification and which components were assessed. Record whether the criteria cover the planned service and processing activity.
Compare the certified processing, modules, data flows, locations and access with the IT contract. For differences, agree an additional review or restrict use to the evidenced scope.
Keep the certificate, subject matter, criteria, body and configuration comparison together. Also review contract points and risks that the certification does not cover.
Article 42 GDPR links certification to data protection-specific procedures, seals and marks. The Austrian Data Protection Authority explains that the subject matter is always processing activities involving personal data. A software product cannot therefore be certified directly under Article 42 without a connected processing activity.
The subject matter must show which processing activities are included and which are excluded. For an IT service, this may involve the module, purpose, data categories and assessed components. A product label without those boundaries leaves the contract value of the mark unclear.
Read the evidence from its subject matter. Ask which processing the provider intends to use under the contract and whether the certification describes the same service. The organisation’s own review begins where the planned data flow differs from that subject matter.
Controllers and processors may apply for a privacy certification from a certification body accredited for that purpose. In Austria, the Data Protection Authority does not issue those certifications itself. It accredits certification bodies by decision.
The IT contract should identify the issuing body clearly. A provider logo or general claim that an assessment occurred does not replace evidence of the body. Keep the name, accreditation link and assignment to the certificate with the contract documents.
This answers a distinct question: who was entitled to conduct the privacy certification procedure? It does not show whether the purchased configuration matches the certified processing. That requires a second comparison with the technical and contractual scope.
The assessment uses approved certification criteria. Article 43(2)(b) GDPR requires the certification body to apply those criteria. The Austrian Data Protection Authority identifies possible assessment areas including GDPR principles, data subject rights, privacy by design under Article 25, suitable technical and organisational measures under Article 32 and remedies within a data protection impact assessment.
For the contract review, the link between criteria and components matters. A criterion may concern a processing step, a technical function or an organisational rule. Record which parts of the service were assessed and which criteria support the statement.
The criteria do not replace the contract review. They make the assessment standard understandable. This lets the organisation determine more precisely whether security, erasure, data subject rights and configuration questions are covered or need separate contractual treatment.
Practical rule: Connect every certification mark to three details: certified processing activity, accredited certification body and approved criteria. Then compare the evidence with the IT contract.
The contract should describe the service so that the certified scope can be compared with actual use. Review modules, enabled functions, data categories, recipients, storage locations and support access. An extra function may alter the processing activity if it introduces new purposes, data or access rights.
Record the comparison in a short allocation: what is covered by the certified subject matter, what use is planned under the contract and which points fall outside the evidence. This prevents a general certification from silently being extended to every provider service.
Where there is a difference, the appropriate response may be a configuration restriction, additional review or further contractual safeguard. The decision must reflect the actual data flow. Continuing to rely on the mark without addressing the difference does not resolve it.
The addressees of a privacy certification are controllers or processors. The evidence therefore has a data protection function and a processing subject matter. It does not replace the separate assessment of who decides the purposes and essential means under the IT contract.
A provider may be certified for processing on behalf of a customer while a separate processing activity requires an assessment of the provider’s own responsibility. The customer remains responsible for its own selection, configuration and use. Certification supports the assessment, but it does not remove the role and risk analysis.
When reviewing a processor, read certificate, service description, instructions, sub-processors and audit rights together. The overview of SaaS roles covers the prior classification. The article on technical and organisational measures explains the organisation’s own security record.
The Data Protection Authority describes certifications as a compliance instrument. They may be taken into account when assessing controller duties and technical and organisational measures. This makes the evidence useful, but it does not create general product approval.
Review services outside the assessed scope as well. Depending on the contract, these may include additional modules, individual settings, support routes, new sub-processors or data flows absent from the certified subject matter. The documents must show whether a specific point is covered.
The scope can change with use. When the service or processing changes, update the allocation and check whether the evidence still fits. The review of processors and service providers remains a separate step for technical and contractual safeguards.
Request the complete certification evidence and the description of its subject matter. Add details of the accredited body and approved criteria. For the contract comparison, also obtain the service description, data flow, modules used and relevant configuration information.
Connect these documents to a concrete decision. Record which processing the mark covers, which points remain outside it and which additional measures the contract requires. Where a processor is involved, include the continuing review of the information supplied by that provider.
Keep the comparison so that a later review can follow the reasoning. Reassess it when the service, data or sub-processors change. The article on records of processing activities can help connect the processing, service and data flow.
Start with the data flow and identify the specific processing activity. Place the certificate, body and criteria next to it. Then compare actual use with the stated scope and record every difference.
For each open point, decide whether the contract needs a clear clause, a technical restriction or additional evidence. Keep the certified part separate from general provider statements and from the organisation’s own duties as controller. This keeps the meaning of the mark precise.
Repeat the comparison when the service changes. The review of subprocessor changes adds the relevant control where the processing chain changes.
Article 42 GDPR concerns processing activities involving personal data. A product name alone does not define that subject matter. The certified processing and assessed components are decisive.
The evidence comes from a certification body accredited for privacy certifications. The Austrian Data Protection Authority does not issue the certification itself; it accredits certification bodies.
The criteria set the assessment standard. Under Articles 42(5) and 43(2)(b) GDPR, they must be approved and fit the specific certification subject matter.
No. It can be one part of the assessment. The contract, roles, instructions, data flows, configuration and services outside the scope must still fit the actual use.
Separate roles and purposes before approving the contract.
Document security measures and effectiveness clearly.
Review contracts, audit rights and provider information.
Map processing, services and data flows in the record.
Receive new articles and legal guidance from the firm with BRANDaktuelle Rechtsnews.
Tell us briefly what is happening. We will help classify the situation and discuss which documents and next step are useful for your business.
Address
BRANDAUER Rechtsanwälte GmbH Giselakai 51 5020 Salzburg Österreich
Phone
+43 662 6280000