wetzoeker

1.3 — Organisational NL accreditation requirements for GDPR code of conduct monitoring bodies

Organisational

1.3.1. The monitoring body shall demonstrate that it has adequate resources (including technical resources)and personnel to effectively perform its tasks, the resources should be proportionate to the expected number and size of code members, as well as the complexity or degree of risk of the relevant data processing, that it is able to act independently from code owners and code members and is protected from interference or sanctions as a result of this duty.

1.3.2. The monitoring body shall provide evidence during the application process that their personnel can act independently and without undue pressure or influence in relation to:

a. supervision of resources and finances of the monitoring body;

b. decisions on and performance of compliance monitoring; and

c. safeguarding of impartiality.

Such evidence can include but is not limited to documented recruitment/appointment processes, job descriptions, risk registers, risk treatments, meeting minutes and other documented processes as appropriate.

1.3.3. Where a monitoring body uses sub-contractors, it shall ensure that sufficient guarantees are in place in terms of the knowledge, reliability and resources of the sub-contractor and obligations applicable to the monitoring body are applicable in the same way to the sub-contractor. Even when subcontractors are used, the monitoring body shall ensure effective monitoring of the services provided by the contracting entity. The use of subcontractors does not remove or diminish the responsibility of the monitoring body. This could be demonstrated with evidence that may include:

a. written contacts or agreements to outline for example responsibilities, confidentiality, what type of data will be held and a requirement that the data is kept secure;

b. a clear procedure for subcontracting shall also be documented and include the conditions under which this may take place, an approval process and the monitoring of subcontractors;

c. requirements relating to the termination of those contracts, in particular so as to ensure that subcontractors fulfil their data protection obligations;

and

d. the monitoring body shall ensure sufficient documented procedures to guarantee the independence, expertise and lack of conflicts of interests of the sub-contractors.

Regeling
NL accreditation requirements for GDPR code of conduct monitoring bodies
Soort
ZBO-regeling
Geldend vanaf
10-03-2021
BWB-id
BWBR0044929
Versie
2021-03-10_0

In de hele regeling · Officiële tekst op wetten.overheid.nl