EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

Article 42 – Certification

Only Parliament amendments would change this article. Parliament committees have tabled 1 amendment to this article.

Latest text22 October 2026ST 14756/26

Contains no amendment to this article.

What each text does

  1. 19 Nov 2025 Commission proposalCOM(2025) 837 No amendment to this article.
  2. 21 May 2026 Council textST 9547/26 No amendment to this article.ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others.
  3. 10 Jun 2026 Council textST 10426/26 No amendment to this article.
  4. 18 Jun 2026 Council textST 10677/26 No amendment to this article.
  5. 27 Jul 2026 ITRE–LIBE amendments 1261–1564 to the draft reportCJ72-AM-791873 1 amendment to this article. Amendments in this document
  6. 3 Sep 2026 Council textST 12535/26 No amendment to this article.
  7. 2 Oct 2026 Council textST 13886/26 No amendment to this article.Page 126 prints “(9a)” without an instruction or target, so no change can be assigned to that marker.
  8. 22 Oct 2026 Council textST 14756/26 No amendment to this article.

Parliament amendments

1 amendment to this article

1 proposes alternative wording.

By political group; co-sponsored amendments count for each group
TypeEPP
~ Alternative1

By political group

  • ~ Alternative EPP 1
  1. 1303 Alternative Axel VossEPP · ITRE–LIBE “for small and medium controllers and large processors. Large controllers must be certified within one year after meeting the conditions in Article…”

    10a. In Article 42, paragraph 3 and 7 are amended as follows:

    3. The certification shall be voluntary and available via a process that is transparent for small and medium controllers and large processors. Large controllers must be certified within one year after meeting the conditions in Article 4(28). 7. Certification shall be issued to a controller or processor for a maximum period of three years for small and medium controller and large processors. Certifications shall be issued for a maximum period of one year for large controllers. It may be renewed, under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the criteria for the certification are not or are no longer met."

    Justification

    RISK-BASED APPROACH #11: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 42 – paragraphs 3 and 7
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 a (new) / Regulation (EU) 2016/679 / Article 42 – paragraphs 3 and 7