# Data Protection Act 2018, Section 17: Accreditation of certification providers


(1) Accreditation of a person as a certification provider is only valid when carried out by—
(a) the Commission, or
(b) the UK national accreditation body.
(2) The Commission may only accredit a person as a certification provider where the Commission—
(a) has published a statement that the Commission will carry out such accreditation, and
(b) has not published a notice withdrawing that statement.
(3) The UK national accreditation body may only accredit a person as a certification provider where the Commission—
(a) has published a statement that the body may carry out such accreditation, and
(b) has not published a notice withdrawing that statement.
(4) The publication of a notice under subsection (2)(b) or (3)(b) does not affect the validity of any accreditation carried out before its publication.
(5) Schedule 5 makes provision about reviews of, and appeals from, a decision relating to accreditation of a person as a certification provider.
(6) The UK national accreditation body may charge a reasonable fee in connection with, or incidental to, the carrying out of the body's functions under this section, Schedule 5 and Article 43 of the UK GDPR.
(7) The UK national accreditation body must provide the Secretary of State with such information relating to its functions under this section, Schedule 5 and Article 43 of the UK GDPR as the Secretary of State may reasonably require.
(8) In this section—
“certification provider” means a person who issues certification for the purposes of Article 42 of the UK GDPR;
“the UK national accreditation body” means the UK national accreditation body for the purposes of Article 4(1) of Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93.

---
Source: https://www.legislation.gov.uk/ukpga/2018/12/section/17 (the official version)
Page: https://openlegislation.uk/data-protection-act-2018/section-17
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.