Article 42. Certification 1. The member states, the supervisory authorities, the board and the commission

shall encourage, in particular at union level, the establishment of data protection certification

mechanisms and of data protection seals and marks for the purpose of demonstrating compliance with

this regulation of processing operations by controllers and processors. The specific needs of micro,

small and medium-sized enterprises shall be taken into account. Two. In addition to adherence by

controllers or processors subject to this regulation, data protection certification mechanisms, seals or marks approved pursuant to paragraph 5 of this article may be established for the purpose of demonstrating the existence of appropriate safeguards provided by controllers or processors that are not subject to this regulation pursuant to Article 3 within the framework of

personal data transfers to third countries or international organizations under the terms

referred to in point F of Article 462. Such controllers or processors shall make binding and

enforceable commitments via contractual or other legally binding instruments, to apply those appropriate

safeguards, including with regard to the rights of data subjects.

3. The certification shall be voluntary and available via a process that is transparent.

4. A certification pursuant to this article does not reduce the responsibility of the controller or the processor for compliance with this regulation and is without prejudice to the tasks and powers of the supervisory authorities which are competent pursuant to Article 55 or 56.

5. A certification pursuant to this article shall be issued by the certification bodies referred to an Article 43 or by the competent supervisory authority, on the basis of criteria approved by that competent supervisory authority pursuant to Article 583 or by the board pursuant to Article 63.

Where the criteria are approved by the board, this may result in a common

certification, the European Data Protection Seal. 6. The controller or processor which

submits its processing to the certification mechanism shall provide the certification body

referred to in Article 43, or where applicable, the competent supervisory authority,

with all information and access to its processing activities which are necessary to conduct the

certification procedure.

7. Certification shall be issued to a controller or processor for a maximum period of three years,

and may be renewed, under the same conditions,

provided that the relevant requirements continue to be met. Certification shall be withdrawn,

...