Home › Knowledge Hub › Codes & Certification Schemes

Knowledge Hub

GDPR codes of conduct & certification schemes

The approved organisational instruments under the GDPR — certification schemes under Article 42 and codes of conduct under Article 40 — for the UK (ICO-approved) and the EU (EDPB-adopted). These are schemes an organisation's processing can be certified against or a code it can sign up to; they are not individual qualifications. UK-first, with a link to each official register.

Compiled & maintained by VulaPri Limited, a UK privacy consultancy · ADISA, LOCS:23 and the Biometric Processing Privacy Code verified 15 September 2026; the remaining entries 5 July 2026

Article 40 vs Article 42 — the difference in a nutshell

Both are accountability tools that let an organisation demonstrate GDPR compliance, and both can act as a safeguard for restricted international transfers — but they work differently.

 Certification schemes — Art. 42Codes of conduct — Art. 40
What it isCriteria against which an organisation's specific processing is certified.A sector code of good practice that member organisations commit to follow.
Who approvesSupervisory authority (or EDPB, for an EU-wide seal) approves the criteria.Supervisory authority approves the code.
Who checks complianceAn accredited certification body issues certification (valid up to 3 years).An accredited monitoring body (Art. 41) oversees members.
Transfer safeguardCan be a transfer tool under Art. 46(2)(f).Can be a transfer tool under Art. 46(2)(e).

UK and EU are separate regimes: UK-approved instruments are approved by the ICO under UK GDPR; EU-approved ones by an EU supervisory authority or the EDPB. An approval under one regime does not automatically carry across to the other.

Live caveat. ICO-register entries currently carry the ICO's notice that, following the Data (Use and Access) Act 2025 (Royal Assent 19 June 2025), the approved criteria and codes remain valid but are under review and may change. The ADISA entry is the exception so far: its criteria were updated for the Act and approved on 18 March 2026, with a transition notice for the earlier version. Confirm current status on the ICO register before relying on any entry.

Certification schemes (Art. 42) — UK, ICO-approved

  • ADISA ICT Asset Recovery Certification 8.0

    ICO-approved criteria: Standard 8.0 v4.0 Part 1 (ICO-CSC/003:2) and Part 2 Criteria (ICO-CSC/004:3), approved 18 March 2026 to reflect the Data (Use and Access) Act 2025 · originally approved 19 July 2021 (v3.1/v3.2, ICO-CSC/003:1 and /004:2, valid until certified organisations have transitioned) · owner and UKAS-accredited certification body: ADISA Certification Ltd (UKAS 23831)

    What it covers: Data protection requirements for processors and sub-processors providing data sanitisation services — permanently removing information from IT hardware so it can be securely disposed of or reused.

    Detail page → · View on the ICO register →

  • Age Appropriate Design Certification Scheme (AADCS)

    ICO-approved criteria (ICO-CSC/002) · body: Age Check Certification Scheme Ltd

    What it covers: Children's online privacy and the design of information society services, aligned to the ICO's Children's Code (Age Appropriate Design Code).

    View on the ICO register →

  • Age Check Certification Scheme (ACCS)

    ICO-approved criteria (ICO-CSC/001) · the first ICO-approved UK GDPR criteria

    What it covers: Age assurance and age verification — the first set of criteria the ICO approved under UK GDPR.

    View on the ICO register →

  • Legal Services Operational Privacy Certification Scheme (LOCS:23)

    ICO-approved criteria ICO-CSC/006 · approved 1 February 2024 · scheme owner: 224Protect Ltd (previously trading as 2Twenty4 Consulting Ltd) · certification body: ADISA Certification Ltd (UKAS accreditation 23831)

    What it covers: Data protection in the legal-services sector — law firms, solicitors, barristers’ chambers and other providers, as controllers and processors, for personal data held in the client file. Criteria document: LOCS:23 Standard v12.3.

    Detail page → · View on the ICO register →

  • UK GDPR Compliance Certification Scheme for the Provision of Training and Qualifications Services

    ICO-approved criteria (ICO-CSC/005)

    What it covers: The handling of learner and candidate data by organisations providing training and qualifications services.

    View on the ICO register →

Certification schemes (Art. 42) — EU, EDPB-adopted

  • Europrivacy — European Data Protection Seal

    Managed by the European Centre for Certification and Privacy (ECCP), Luxembourg · EU

    What it covers: A general-purpose GDPR certification scheme and the first to be adopted by the EDPB as the official European Data Protection Seal (EDPB Opinion 28/2022). In April 2026 the EDPB issued further opinions updating the scheme's criteria and extending its scope — including to non-EEA organisations caught by Art. 3(2) — and recognising it as a tool for restricted international transfers under Articles 42 and 46.

    Note: The individual Europrivacy Implementer and Auditor credentials sit in our Certifications directory.

    Visit the Europrivacy site →

Codes of conduct (Art. 40) — UK, ICO-approved

  • ABI UK GDPR Code of Conduct for Investigative & Litigation Support Services

    ICO-approved code (ICO-CC/001) · owner: Association of British Investigators · approved 15 October 2024

    What it covers: The first ICO-approved UK GDPR code of conduct. It helps members providing investigative and litigation-support services demonstrate compliance — covering controller/processor roles, DPIAs, lawful basis, legitimate-interests assessments and consent to share when tracing and locating individuals.

    View on the ICO register →

Codes of conduct (Art. 40) — EU, transnational

  • EU Cloud Code of Conduct (EU Cloud CoC)

    Approved by the Belgian DPA (20 May 2021) · monitoring body: SCOPE Europe · EU

    What it covers: An Article 40 code for cloud service providers acting as processors under Article 28, covering the full cloud stack (IaaS, PaaS and SaaS).

    Visit the EU Cloud CoC site →

  • CISPE Data Protection Code of Conduct

    Approved by the CNIL (France) · EU

    What it covers: An Article 40 code for cloud infrastructure (IaaS) providers, developed by CISPE and approved by the French supervisory authority.

    Visit the CISPE code site →

Statutory codes of practice — other jurisdictions

Codes issued by a regulator with the force of law under its own statute — not Article 40 industry codes. Listed where they offer a useful comparator for UK practice.

  • Biometric Processing Privacy Code 2025 (BPPC)

    Issued by the Privacy Commissioner under the Privacy Act 2020 · New Zealand · issued 21 July 2025, in force 3 November 2025; transition for existing users ended 3 August 2026; Amendment No 1 (March 2026) in force 1 May 2026

    What it covers: Privacy rules for agencies collecting and using biometric information in biometric processing (facial recognition and similar) — a proportionality test before collection, transparency duties, and limits on use such as detecting health information without specific authorisation. Six OPC factsheets and full guidance accompany it.

    Detail page → · Read the Code on privacy.org.nz →

This directory is curated for authority over volume and expanding. Think a scheme or code is missing, or spot a detail to fix? Flag it for the curation team — curated lists take tip-offs, not self-listings. Listing is not an endorsement, and general reference only, not legal advice — confirm current status on the ICO or EDPB register.