○ ○ ○ ○ ○
Strongly agree Somewhat agree Neither agree nor disagree Somewhat disagree Strongly disagree
Please explain your answer, and provide supporting evidence where possible.
Q3.3.8. Are there any mechanisms that could be supported that would benefit UK organisations if they were recognised by the Secretary of State? ○ Yes ○ No ○ Don’t know Please explain your answer, and provide supporting evidence where possible.
3.4 Certification Schemes Explanatory box: What are certification schemes? Certification schemes are voluntary, market-driven frameworks of context-specific rules that, under the UK GDPR, can be used to demonstrate a high standard of compliance and to provide appropriate safeguards for international transfers. Certifications are characteristically framed at the sectoral or industry level, defining data protection rules and practices covering specific products, processes and services within the context of that sector, industry or similar group. Private bodies can develop criteria for certification schemes to the standards set in legislation and by the ICO. The criteria is submitted for assessment and prospective certification bodies are accredited by the UK Accreditation Service. Once accredited, the certification body will assess prospective businesses to see if they meet the requirements to join the scheme. Certification schemes are complex measures that require significant time and resources to design, implement and maintain, and they demonstrate accountability and represent the highest standards of data protection.
266. The government is considering modifications to the framework for certification schemes to provide for a more globally interoperable market-driven system that better supports the use of certifications as an alternative transfer mechanism. The UK GDPR’s accountability principle is central to certification. It is the requirement for organisations to take responsibility for what they do with personal data and how they comply with the UK GDPR. 82 Other jurisdictions take different approaches to defining how standards of accountability should be demonstrated. Their approaches can also require high standards of data protection, but present those 82
See chapter 1 for more detail on accountability
98
