Certified information security management

EDPO has been ISO 27001 certified since February 2023. Our current certificate — no. K-0229128/1, issued by Vinçotte (a Kiwa company) under BELAC accreditation — covers all processes involved in the provision of Representative services under the GDPR, the UK GDPR, the Swiss FADP, NIS2, the AI Act and the Data Act, in the EU/EEA, the UK and Switzerland, for companies located outside those regions.

The certificate is held by EDPO’s Belgian entity, and its scope extends to the representative services rendered by EDPO UK and EDPO Switzerland.

The certified scope includes our Information Security Management System (ISMS), Leadership, Human Resources, Infrastructure, Purchasing, Office Management, Sales and Account Management.

Geographically, the scope covers the EU/EEA, the United Kingdom and Switzerland, for services we provide to companies located outside those regions.

“All processes involved in the provision of Representative services under the GDPR, the UK GDPR, the FADP, NIS2, the AI Act and the Data Act, in the EU/EEA, the UK and Switzerland for companies located outside the EU/EEA and/or the UK and/or Switzerland.”

Certificate K-0229128 — scope, verbatim

Certification means an organisation has implemented an Information Security Management System — a documented set of policies, controls and processes for identifying and managing information security risks — and that an independent, accredited body has audited that system and confirmed it meets the standard.

Certification is not a one-off exam. Certified organisations are audited every year and fully recertified every three years. EDPO has held the certification without interruption since February 2023.

The GDPR does not require any particular certification. Article 32 requires appropriate technical and organisational measures, and leaves each organisation to determine what is appropriate for the risks it handles. The Regulation does provide for its own certification mechanisms under Article 42, but ISO 27001 is not one of them.

ISO 27001 is a way of showing that those measures exist, are documented, and are checked by someone who does not work for us. We hold it because our clients entrust us with their regulatory correspondence — not because a regulation obliges us to.

Data subject requests, correspondence with supervisory authorities, records of processing activities, compliance documentation and confidential business information all pass through us. Certification changes what you are relying on when they do: