Section 17: Accreditation of certification providers

Data Protection Act 2018 · 2018 c. 12View on legislation.gov.uk

Part 2: General processing — CHAPTER 2: The UK GDPR

Accreditation of a person as a certification provider is only valid when carried out by—

the Commissioner, or
the UK national accreditation body.

The Commissioner may only accredit a person as a certification provider where the Commissioner—

has published a statement that the Commissioner will carry out such accreditation, and
has not published a notice withdrawing that statement.

The UK national accreditation body may only accredit a person as a certification provider where the Commissioner—

has published a statement that the body may carry out such accreditation, and
has not published a notice withdrawing that statement.

The publication of a notice under subsection (2)(b) or (3)(b) does not affect the validity of any accreditation carried out before its publication.

Schedule 5 makes provision about reviews of, and appeals from, a decision relating to accreditation of a person as a certification provider.

The UK national accreditation body may charge a reasonable fee in connection with, or incidental to, the carrying out of the body's functions under this section, Schedule 5 and Article 43 of the UK GDPR.

The UK national accreditation body must provide the Secretary of State with such information relating to its functions under this section, Schedule 5 and Article 43 of the UK GDPR as the Secretary of State may reasonably require.

In this section—

  • "certification provider" means a person who issues certification for the purposes of Article 42 of the UK GDPR;

  • "the UK national accreditation body" means the UK national accreditation body for the purposes of Article 4(1) of Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93.

About this text

This legislation text comes from legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. These source and reuse terms cover the legislation text, not Remedy's commentary.

Reuse reviewed 21 August 2026 under Open Government Licence v3.0.