Data processors gain a competitive advantage and market share through GDPR certification, a new market force that will reshape the data processing landscape.

Under Art. 28 GDPR, service providers represent legal and financial risks for their clients. In the event of a data breach by a service provider acting as a data processor, its clients, the data controllers, are liable and can be fined by default up to 2% of their worldwide turnover under Art. 83(4) GDPR, or up to 4% if, for instance, the incident is also considered a breach of Art. 5 GDPR.

Art. 28 GDPR states:

“Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.”

In other words, it is the data controller’s responsibility to demonstrate that its data processors comply with the applicable GDPR provisions. Fortunately, the same article recognises the GDPR certification of a data processor as a means “to demonstrate sufficient guarantees”.

Now that Europrivacy has been approved for use worldwide, this mechanism is available to both European and non-European data processors.

The alternative is for the data controller to perform regular compliance verifications of its data processors and the technical and organisational measures they have in place.

Such work, if properly performed, requires substantial due diligence efforts and generates costs for both parties: the data controller and its data processors.

The consequence is logical.

Where a data controller has to choose between two competing offers from two service providers—one GDPR-certified and the other uncertified—it will rationally choose the certified one, which will reduce its risk exposure and due diligence monitoring costs.

Over time, we can anticipate that GDPR certification will be increasingly integrated into the procurement policies of data controllers to reduce risks and costs.

Certified service providers will enjoy a significant competitive advantage that will progressively shift market shares from uncertified service providers to certified ones.

Take the next step with Europrivacy:

Welcome Pack: europrivacy.com/en/welcomepack

Save Risks and Costs with Certified Processors: europrivacy.com/en/procurement-support

The post GDPR Certification as a Competitive Advantage for Data Processors appeared first on Europrivacy Community.