vendor-cert-acceptance

Vendor Certification Acceptance Criteria

Overview

GDPR Article 42 establishes a framework for data protection certification mechanisms, and Article 28(5) notes that a processor's adherence to an approved certification mechanism may be used as an element to demonstrate sufficient guarantees. The EDPB Guidelines 07/2020 (paragraph 86) confirm that certifications may serve as indicators of processor reliability, though they do not discharge the controller's obligation to conduct its own assessment.

Vendor certifications and attestations provide structured evidence of control implementation, but their value depends on scope coverage, certification body credibility, recency, and relevance to the specific processing relationship. Summit Cloud Partners maintains a Certification Acceptance Framework that defines which certifications are recognized, how they are evaluated, and what supplementary measures are needed when certification coverage has gaps.

Recognized Certification Frameworks

Tier A: Strong Privacy Certifications

Certifications specifically designed for privacy/data protection management, independently audited.

ISO/IEC 27701:2019 — Privacy Information Management System (PIMS)

Aspect	Detail
Standard	Extension to ISO 27001/27002 for PII management
Scope	PII controller (Annex A) and PII processor (Annex B) controls
Certification body	Accredited ISO certification bodies
Audit type	Third-party certification audit (Stage 1 + Stage 2)
Validity	3-year cycle with annual surveillance audits
GDPR relevance	High — maps directly to GDPR requirements per Annex D
Acceptance criteria	Certificate scope must cover processing services provided to Summit
Verification	Check accreditation body registry; verify scope statement
Supplementation needed	Verify that Annex B (processor) controls are in scope; if only Annex A (controller), supplementary processor assessment required

GDPR Certification per Article 42

Aspect	Detail
Standard	Certification per criteria approved by supervisory authority or EDPB
Certification body	Accredited per Article 43 by national accreditation body and supervisory authority
GDPR relevance	Maximum — specifically designed for GDPR compliance demonstration
Acceptance criteria	Certificate issued by Article 43 accredited body; scope covers processing
Current status	Very few Article 42 certifications currently available (as of March 2026)
Supplementation needed	Minimal if scope covers all processing activities

Tier B: Strong Security Certifications with Privacy Elements

Certifications primarily security-focused but including privacy-relevant controls.

SOC 2 Type II with Privacy Trust Services Criterion

Aspect	Detail
Standard	AICPA Trust Services Criteria — Privacy criterion
Scope	Notice, choice, collection, use/retention/disposal, access, disclosure, security, quality, monitoring
Audit type	Independent CPA examination over minimum 6-month period
GDPR relevance	Moderate-High — covers many Article 28/32 requirements but US-centric
Acceptance criteria	Type II (not Type I); Privacy criterion included; no qualified opinions; scope covers relevant services
Verification	Request full report under NDA; review scope, findings, exceptions
Supplementation needed	GDPR-specific gap assessment required: cross-border transfer controls, DPA-specific obligations, sub-processor cascade

SOC 2 Type II (Security Criterion Only)

Aspect	Detail
Acceptance criteria	Type II; no qualified opinions; scope covers relevant services
GDPR relevance	Moderate — covers Article 32 security measures
Supplementation needed	Full privacy assessment required for non-security GDPR obligations

ISO/IEC 27001:2022 — Information Security Management System

Aspect	Detail
Acceptance criteria	Current version (2022 preferred); scope covers processing services; accredited certification body
GDPR relevance	Moderate — strong for Article 32 security; does not address privacy-specific requirements
Supplementation needed	Privacy gap assessment covering Art. 28(3) obligations, DSR assistance, breach notification, data handling

Tier C: Domain-Specific Certifications

ISO/IEC 27018:2019 — Cloud Privacy

Aspect	Detail
Scope	Cloud-specific PII protection controls
Acceptance	Relevant only for cloud service providers; supplements ISO 27001
Supplementation	Must be combined with ISO 27001; does not stand alone

CSA STAR Level 2 — Cloud Security

Aspect	Detail
Scope	Cloud Controls Matrix (CCM) third-party audit
Acceptance	Level 2 (third-party audit) required; Level 1 (self-assessment) insufficient as standalone
Supplementation	Cloud security focus; privacy gap assessment required

APEC Cross-Border Privacy Rules (CBPR) System

Aspect	Detail
Scope	Asia-Pacific cross-border data transfer framework
Acceptance	Recognized for APEC economy vendors; does not substitute for GDPR compliance
GDPR relevance	Limited — different legal framework; may indicate privacy program maturity
Supplementation	Full GDPR compliance assessment still required

EU Cloud Code of Conduct (SCOPE Europe)

Aspect	Detail
Standard	GDPR Article 40 approved code of conduct for cloud services
Scope	Cloud service provider GDPR compliance
Acceptance	Approved by Belgian DPA as monitoring body (2021)
GDPR relevance	High — specifically mapped to GDPR obligations
Supplementation	Minimal for in-scope cloud processing; verify monitoring body oversight

Tier D: Self-Assessments and Basic Certifications

Certification	Acceptance Level
CSA STAR Level 1 (self-assessment)	Accepted as supplementary evidence only; not standalone
Vendor privacy policy / self-declaration	Not accepted as certification; supplementary only
HITRUST CSF	Accepted for healthcare contexts; GDPR gap assessment required
Cyber Essentials (UK)	Basic security only; full assessment required

Certification Equivalence Matrix

Maps certification coverage against GDPR Article 28 requirements:

GDPR Requirement	ISO 27701	SOC 2 Privacy	SOC 2 Security	ISO 27001	ISO 27018	Art. 42 Cert
Art. 28(3)(a) Documented instructions	Full	Partial	None	None	Full	Full
Art. 28(3)(b) Confidentiality	Full	Full	Partial	Full	Full	Full
Art. 28(3)(c) Security (Art. 32)	Full	Full	Full	Full	Full	Full
Art. 28(3)(d) Sub-processor mgmt	Full	Partial	None	Partial	Full	Full
Art. 28(3)(e) DSR assistance	Full	Partial	None	None	Partial	Full
Art. 28(3)(f) Compliance assistance	Full	Partial	None	None	None	Full
Art. 28(3)(g) Deletion/return	Full	Full	None	Partial	Full	Full
Art. 28(3)(h) Audit rights	Full	Partial	None	Partial	Full	Full
Art. 33(2) Breach notification	Full	Full	Partial	Partial	Partial	Full
Ch. V International transfers	Partial	None	None	None	None	Full

Legend: Full = requirement addressed, Partial = partially addressed, None = not addressed

Gap Supplementation Requirements

When a vendor holds certifications that do not fully cover GDPR requirements, Summit Cloud Partners requires supplementary evidence for uncovered obligations:

Gap	Supplementation Method
DSR assistance capability	Vendor provides DSR handling procedure documentation and SLA commitments
Sub-processor management	Vendor provides sub-processor list, notification mechanism, and flow-down DPA sample
Breach notification process	Vendor provides incident response plan with notification timeframes
International transfer controls	Vendor provides Transfer Impact Assessment and supplementary measures documentation
Deletion/return capabilities	Vendor demonstrates deletion procedure and provides sample deletion certificate
Audit facilitation	DPA audit rights clause verified; vendor confirms practical audit access

Certification Verification Process

Step	Activity	Evidence
1	Obtain copy of certificate and audit report	PDF certificate; SOC 2 report under NDA
2	Verify certification body accreditation	Check national accreditation body registry
3	Verify certificate validity (not expired)	Certificate dates; annual surveillance confirmation
4	Verify scope covers relevant services	Scope statement includes services provided to Summit
5	Review exceptions or qualified opinions (SOC 2)	No material exceptions affecting Summit data
6	Identify gaps per equivalence matrix	Document uncovered requirements
7	Request supplementary evidence for gaps	Per gap supplementation table
8	Document acceptance decision	Record in vendor assessment file

Key Regulatory References

• GDPR Article 42 — Data protection certification mechanisms
• GDPR Article 43 — Certification bodies
• GDPR Article 40 — Codes of conduct
• GDPR Article 28(5) — Adherence to certifications as element of sufficient guarantees
• EDPB Guidelines 07/2020 — Paragraph 86 on certifications as sufficiency indicators
• EDPB Guidelines 1/2018 — Certification and identifying certification criteria per Article 42
• ISO/IEC 27701:2019 — Privacy information management system
• AICPA Trust Services Criteria — Privacy criterion (2017 revision with 2022 updates)
• APEC Cross-Border Privacy Rules System — Policies, Rules, and Guidelines
• EU Cloud Code of Conduct — SCOPE Europe (approved 2021)