Certification schemes
Latest updates - 13 February 2026
13 February 2026 - This guidance has been updated to reflect changes to UK GDPR due to the Data (Use and Access) Act coming into law on 19 June 2025.
23 May 2025 - We have updated the content to reflect changes to the certification scheme development process, including the relevant assessment requirements for each stage of that process.
28 July 2022 - we have updated our guidance to include answers to questions on market demand. You can find this under “How do we develop a certification scheme?”.
This guidance discusses certification schemes in detail. Read it if you have detailed questions not answered in the Guide to the UK GDPR, or if you need a deeper understanding. This guidance will be useful for organisations considering writing, monitoring or signing up to a certification scheme.
If you haven’t yet read certification schemes in brief in the guide, you should read that first. It sets out the key points you need to know and includes frequently asked questions regarding certification schemes.
How do we apply for UK GDPR certification?
- What are the requirements?
- What should we consider before applying?
- How much does it cost to be certified?
- How will people know about our certification?
- Will the ICO consider certification as a mitigating factor in an investigation?
How do we become a certification body?
- What do we need to know before applying to become a certification body?
- How do we apply to become a certification body?
- What is a certification body’s relationship with the ICO?
- How will people know about our accreditation?
- What information will be published?
- Further information
How do we develop a certification scheme
- What are certification schemes?
- What can a UK GDPR scheme be about?
- Why does the ICO consider market demand?
- How should we consider market demand?
- What can be certified?
- What are the requirements for UK GDPR certification criteria?
- Do we need to describe the evaluation methods?
- Does the scheme include the use of a certification mark?
- How should we test our scheme?
- How can the ICO help?
- How will the ICO assess the scheme criteria?
- How will people know our criteria have been approved?
- How do certification schemes work as an international transfer tool?