Article 43

10b. In Article 43, paragraphs 2 and 7 are replaced by the following:

2. Certification bodies referred to in paragraph 1 shall be accredited in accordance with that paragraph only where they have: (ea) have not repeatedly and knowingly certified processing or other conduct that clearly violated guidelines or recommendation under Article 70(1)(d) that was issued before the certification or have not repeatedly and knowingly certified processing that was later subject to corrective powers under Article 58(2) or fines under Article 83. 7. Without prejudice to Chapter VIII, the competent supervisory authority or the national accreditation body shall revoke an accreditation of a certification body pursuant to paragraph 1 of this Article where the conditions for the accreditation are not, or are no longer, met or where actions taken by a certification body infringe this Regulation. Supervisory authorities shall report complaints under Article 77, any exercise of corrective powers under Article 58(2) and any fine under Article 83 against a controller or processor that was certified to the relevant certification body and the competent supervisory authority that has accredited the relevant certification body."

Justification

RISK-BASED APPROACH #12: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.