GDPR requirements explained: video brief

Not in the way ISO certification exists. Article 42 allows voluntary certification, issued by bodies accredited under Article 43 against criteria approved by a supervisory authority or the European Data Protection Board; the Board's register lists only a handful of approved mechanisms, Europrivacy among them, and Article 42(4) says certification does not reduce the controller's or processor's responsibility. A "GDPR certificate" from outside that register is a badge, not a certification.

No standard does. ISO/IEC 27701 is a certifiable privacy management system standard that maps closely to the GDPR's obligations, and ISO/IEC 27001 evidences the security Article 32 asks for; both are strong evidence of a managed programme. Neither is an Article 42 certification, and neither replaces the legal analysis of your lawful bases, notices, contracts and transfers.

If you offer goods or services to people in the EU, paid or free, or monitor their behaviour there, Article 3(2) applies wherever you are, and Article 27 usually requires a representative in the Union. If you process personal data for an EU client as a processor, your obligations arrive through the Regulation and the Article 28 contract the client must sign with you.

Article 37 requires one for public bodies, for organisations whose core activities involve regular and systematic monitoring of individuals on a large scale, and for those whose core activities involve large-scale processing of special-category or criminal-conviction data. Others appoint one voluntarily. Either way, document the decision; the DPO may be an employee or a contractor, acts independently and reports to top management.

Article 33 requires the controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to individuals; a late notification must explain the delay. Where the risk is high, Article 34 requires affected people to be told without undue delay. Processors notify their controllers, and every breach, reported or not, goes in the register.