Comparing with other GDPR mechanisms
The GDPR recognises four main instruments available to Data Controllers and Processors: certification, code of conduct, corporate binding rules, and standard contractual clauses.
As illustrated in the table below, with 73 formal GDPR references (more than all other mechanisms combined together), certification is the most widely recognized instrument in terms of legal benefits. For instance, it is the only mechanisms that is formally recognized to demonstrate data protection by design and by default (Art. 25 GDPR). It is also recognized to demonstrate the adequacy of Data Controllers and Processors obligations (Art. 24 and 28 GDPR), and security measures in place (Art. 32 GDPR). The authorities also have the obligation to take it into account when determining the level of sanction (Art. 83 GDPR).
| Certification | CC | BCR | SCC | |
|---|---|---|---|---|
| Data protection by design & by default (Art. 25 GDPR) | Yes | No | No | No |
| Adequacy of Data Controllers (Art. 24 GDPR) | Yes | Yes | No | No |
| Adequacy of Data Processors (Art. 28 GDPR) | Yes | Yes | No | No |
| Adequacy of security (Art. 32 GDPR) | Yes | Yes | No | No |
| Impact on administrative fines under (Art. 83 GDPR) | Yes | Yes | No | No |
| Universality: Cross-industry applicability | Yes | No | No | Yes |
| Valuable as an intangible asset | Yes | No | No | No |
| Possibility to focus on priority data processing | Yes | No | No | Yes |
| Scalability (1 for all B2B partners) | Yes | Yes | Yes | No |
| Number of GDPR references | 73 | 36 | 25 | 7 |
As illustrated by the table:
- Certification is mentioned 73 times in 12 articles
- Codes of conducts are mentioned 36 times in 10 articles
- Corporate Binding Rules are mentioned 25 times in 7 articles
- Standard Contractual Clauses are mentioned 7 times in 2 articles
Conclusion
Each GDPR instrument offers a different set of benefits and level of reliability with regards to effective compliance. It is up to each Privacy Professional to assess and choose the one that best addresses the needs of its employer. We hope this analysis will help you on comparing and choosing.
In case you change your mind, moving from one instrument to another, or combining several instruments is quite simple, once you have checked and documented your compliance.
References
| Instrument | Nb GDPR References | Articles | Recitals |
|---|---|---|---|
| Standard Contractual Clauses | 7 | 28, 57 | 81, 109, 168 |
| Binding Corporate Rules | 25 | 4, 46, 47, 49, 57, 58, 64, 70 | 107, 108, 110, 168 |
| Codes of Conduct | 36 | 24, 28, 32, 35, 40, 41, 46, 57, 58, 64, 70, 83 | 77, 81, 98, 99, 148, 168 |
| Certification | 73 | 24, 25, 28, 32, 42, 43, 46, 57, 58, 64, 70, 83 | 77, 81, 100, 166, 168 |