An important objective of Europrivacy is to ensure uniformity, consistency and homogeneity in the certification process by leveraging several mechanisms:
- Europrivacy uses a set of core criteria that are mandatory and applied to all Targets of Evaluation and certification processes.
- It uses complementary criteria to address technology- and domain-specific requirements whose application is determined by the Target of Evaluation and not by the auditor. The auditor must go through the complete list of complementary criteria and must systematically apply all those which are applicable to the Target of Evaluation.
- The Criteria have been worded and formatted in a manner that prevents subjectivity in the assessment and validation of the criteria. Each criterion is focused on factual validations and evidence so that whoever is the auditor, the criteria assessment results should be identical.
- In all cases, the applicability of criteria is not decided by the auditor but determined by the Target of Evaluation.
- All Europrivacy experts must follow a dedicated training through the Europrivacy Online Academy and must successfully pass an exam in order to serve as an auditor or implementer.
- A series of online guides and resources are made available to the implementers and auditors to prepare, document and perform the certification, including specific guidelines on the use of the criteria.
- The Europrivacy community website enables experts to share questions and knowledge.
- In case of need or doubt with regards to the application of criteria, hotline support is made available by the scheme owner to the qualified auditors.
Altogether, Europrivacy enables the certification process to be efficient and homogeneous for all data processing activities, while addressing the risks that are specific to certain categories of data processing activities.