Part 2: General processing Chapter 2: The GDPR Section 17: Accreditation of certification providers
Article 42 of the GDPR encourages Member States to establish data protection certification mechanisms for the purpose of demonstrating compliance with the requirements in the GDPR Certificates can be issued by the supervisory authority or by certification providers.
	Under Article 43 of the GDPR, Member States must ensure any certification providers are accredited by the relevant authorities. The Regulation empowers both the supervisory authority and the national accreditation body to accredit certification bodies, and sets out the criteria which must be taken into account.
	This section outlines the process and requirements for accrediting certification bodies to oversee the certification mechanisms outlined in Article 42.
	Subsection (2) provides the conditions that the Commissioner must meet to accredit a person as a certification provider.
	Subsection (3) provides the conditions that the national accreditation body must meet to accredit a person as a certification provider; when the Commissioner has published a statement that the body may carry out such accreditation, which has not been withdrawn by notice.
	Subsection (4) provides for the validity of any accreditation carried out before publication of a notice under (2)(b) or (3)(b).
	Subsection (5) introduces Schedule 5 which makes provision about reviews and appeals of decisions of the accreditation authorities.
	Subsection (6) provides the national accreditation body with a power to charge fees in respect of its accreditation functions under the Act.
	Subsection (7) outlines that the national accreditation body must provide information to the Secretary of State relating to the accreditation it carries out under the GDPR.
	Subsection (8) defines "certification provider" as meaning a person which issues certification for the purposes of Article 42 of the GDPR. It also defines the national accreditation body as the same body as that in Article 4(1) of Regulation (EC) 765/2008, setting out the requirements for accreditation and market surveillance. In the United Kingdom, this is currently the United Kingdom Accreditation Service (UKAS).
	A data controller or processor claiming to be certified under Article 42, but which has not been certified by a certification provider accredited by either of the two bodies specified in this section is likely to be in breach of the business and consumer protection provisions in the Business Protection from Misleading Marketing Regulations 2008 (S.I. 2008/1276) or the Consumer Protection from Unfair Trading Regulations 2008 (S.I. 2008/1277).