A processor markets 'GDPR certification' stickers but cannot show encryption, access control, or incident response capable of protecting the personal data. What should the controller prioritise?
Select an answer to reveal the explanation.
Short Explanation
Stickers don't encrypt databases. Dig into real controls and the contract—access locks, crypto, incident plans—before trusting a 'GDPR certified!' badge. Marketing is loud; measures are what protect people.
Full Explanation
Controllers must ensure processors provide sufficient guarantees of appropriate technical and organisational measures. A vendor that markets “GDPR certification” stickers yet cannot show encryption, access control, or incident-response capability offers branding without substance. The controller should prioritise demonstrable TOMs and contractual security commitments over marketing claims alone when citizen or customer personal data are at stake.
Accepting any sticker that uses the letters “GDPR” as conclusive Article 32 proof confuses advertising with assurance. Preferring processors who refuse to describe controls in favour of logos inverts due diligence. Genuine certification or codes of conduct can support confidence when relevant and verified, but unsupported stickers do not.
Exam caveat: look for evidence of controls and contract language, not merely the word “certified.” Operational check: request security whitepapers, independent test summaries, incident playbooks, and TOM annexes; validate answers in questionnaires; walk through a sample incident scenario with the vendor. Municipal procurement should refuse to treat protection of resident data as a logo contest and should document why substance-free certification claims were rejected.