There is no official GDPR certificate. No EU body issues one, no company can hold one, and any provider selling a “GDPR certified” badge is selling something the regulation does not recognise. What exists instead: approved certification schemes under Article 42 (Europrivacy is the first), ISO 27701 as the certifiable privacy management standard, and the evidence pack that customers and auditors actually accept as proof of compliance. This guide covers all three, and what to do when a customer says “prove it”.
Why “get GDPR certified” is a trick question
GDPR is a regulation, not a standard. You comply with it the way you comply with tax law: continuously, with evidence, and without a certificate at the end. The regulation deliberately built accountability on documentation rather than badges, which is why the question “how do we get GDPR certified?” has no direct answer, and why anyone offering a direct answer deserves suspicion.
The question usually arrives from somewhere specific: an enterprise customer’s security questionnaire, a procurement checklist, or an investor’s diligence list. None of those parties expects a GDPR certificate. They expect you to demonstrate compliance, and they have seen enough real evidence packs to recognise one.
The two questions people actually mean
“GDPR certification” searches split into two different intents, and mixing them up wastes money. If you mean your company, keep reading: the answer is an evidence pack, possibly topped with ISO 27701 or ISO 27001. If you mean yourself, as a career credential, you are looking for personal qualifications such as the IAPP’s CIPP/E, which certify a person’s knowledge of the regulation, not an organisation’s compliance. This guide is about the company question.
What formally exists: Article 42 schemes
GDPR Article 42 allows certification schemes approved by data protection authorities, and the European Data Protection Board endorsed the first one, Europrivacy, in 2022. It certifies specific processing activities against detailed criteria, through an assessment by an approved certification body.
In practice, adoption is thin. Few companies hold it, few buyers request it, and certifying individual processing activities is a poor fit for a fast-moving software product. It exists, it is legitimate, and for most software companies it is not the answer to the question they are really being asked.
ISO 27701: the certifiable privacy standard
If your buyer wants a certificate with privacy on it, ISO 27701 is the real-world answer. It extends ISO 27001 into privacy information management: how personal data is governed, protected and evidenced across the organisation. An accredited certification body audits you, and the certificate that results is exactly the kind of independent proof enterprise security teams recognise.
It is not “GDPR certification”, because nothing is. It is a certified privacy management system that maps closely onto GDPR’s accountability requirements, which is why it has become the standard answer for software companies whose customers keep asking. Atoro delivers ISO 27701 alongside ISO 27001, so the security and privacy certifications come out of one programme rather than two projects.
What buyers actually accept as proof
When a customer asks you to prove GDPR compliance, they are asking for an evidence pack, and the contents are predictable:
- A current privacy policy that matches what your product actually does
- Your Record of Processing Activities (RoPA)
- Your DPA and sub-processor list
- DPIAs for higher-risk processing
- Working processes for data subject requests and breach response
- A named EU or UK representative if you are established outside those jurisdictions
- A Data Protection Officer where the regulation requires one
- Security certification alongside, most often ISO 27001
Companies that keep this pack current close security reviews in days. Companies that assemble it per-questionnaire lose weeks per deal. Building and maintaining that pack is the core of Atoro’s GDPR compliance services.
What does GDPR certification cost?
There is no official certificate, so there is nothing official to buy, and any quote for “getting you GDPR certified” deserves scrutiny of what is actually being sold. The real costs sit elsewhere: building the compliance programme itself, and optionally certifying against ISO 27701 or ISO 27001 through an accredited body, where fees scale with company size and scope. Anyone quoting a large fixed price for “GDPR certification” as such is selling the myth.
FAQs
Is there an official GDPR certification?
No. The GDPR has no official certificate, and no EU body issues one. Article 42 of the regulation allows approved certification schemes, and Europrivacy is the first scheme endorsed under it, but adoption is limited and customers rarely ask for it. What customers ask for is evidence of compliance, which is documentation, not a certificate.
What is Europrivacy and do we need it?
Europrivacy is the first certification scheme formally endorsed under GDPR Article 42. It certifies specific processing activities rather than a whole company, involves a formal assessment by an approved body, and suits organisations whose buyers or regulators specifically request it. For most software companies it is not the practical route: the same effort put into a documented privacy programme and ISO 27001 answers far more customer questions.
Is ISO 27701 the same as being GDPR certified?
No, but it is the closest certifiable thing. ISO 27701 extends ISO 27001 to privacy information management, an accredited body audits you, and you receive a certificate you can show buyers. It does not certify GDPR compliance as such, and no certificate does, but it is strong, independently verified evidence that your privacy management works. Atoro delivers ISO 27701 alongside ISO 27001.
Can we put a GDPR compliance badge or logo on our website?
There is no official GDPR badge or logo, and any generic seal you can buy carries no legal weight. If a provider offers one, you are paying for an image. State plainly in your privacy policy and trust page how you comply; buyers who care will ask for the evidence, not the icon.
A customer asked us to prove we are GDPR compliant. What do we send?
Typically: your privacy policy, a summary of your privacy programme, your Record of Processing Activities, your DPA and sub-processor list. A description of how you handle data subject requests and breaches, and any certifications you hold, most often ISO 27001. If you are outside the EU or UK, they will also expect a named representative. A clean, current evidence pack answers most questionnaires in one pass.
If our cloud provider and payment processor are GDPR compliant, are we compliant?
No. Compliant vendors cover their own processing, not your obligations. As the controller you still answer for lawful basis, transparency, data subject rights, retention and the contracts behind each processor. Vendor compliance is one input to your compliance, never a substitute for it.
What GDPR certification should I get personally, as an individual?
That is a different question from company certification. Personal credentials such as the IAPP’s CIPP/E or PECB’s GDPR qualifications certify a person’s knowledge, not an organisation’s compliance. If a customer is asking about your company, a team member holding CIPP/E is a good signal but it is not company-level evidence.
Being asked to prove GDPR compliance and not sure what to show? Atoro builds the evidence pack, the programme behind it, and the ISO 27001 and ISO 27701 certifications that carry it. Speak to a consultant and you will get a straight answer on what your buyers actually need.