New GDPR Codes of Conduct and Certifications Register is live!

The long and arduous search for a comprehensive list of GDPR Codes of Conduct and Certifications is finally over! We are thrilled to announce the launch of our new register, an essential tool for privacy professionals, legal experts, and organizations navigating the complexities of GDPR compliance. The register provides a clear and centralized overview of approved and operationalized frameworks, putting an end to the "unreasonably hard" task of finding this crucial information.

Contrary to popular belief, codes of conduct and certifications are not a dead end. In fact, a surge of activity has been observed, with almost half a dozen new projects either operationalized or approved between late 2024 and throughout 2025.

Our high-level statistics reveal a bustling landscape: the register currently includes 8 certifications and 32 codes of conduct, with more being added as they become available.

Our initial high-level analysis of the register reveals some key statistics:

• Top Authorities: The Austrian DSB holds the highest count of registered frameworks, with 8, followed by the Italian GPDP with 6. Germany also ranks high, with a total of 7 frameworks, but they are spread across several of its federal states.
• Territorial Scope: The ratio of transnational frameworks to national and regional frameworks is 3:17.
• Eligibility: The ratio of frameworks for private bodies to public bodies is 7:1, meaning that 87.5% of the frameworks are for private bodies.

These insights underscore the growing importance of these frameworks for the private sector and highlight the leadership of certain authorities in their approval. These insights were already possible without lengthy analyses. Even better conclusions and statistics may be drawn in future. 

Building this register has been an enlightening experience, and it has highlighted some of the challenges that privacy professionals face. We discovered that official registers from authorities are not always as easy to find as one would expect. Furthermore, we often encountered inconsistencies between frameworks listed nationally and those mirrored at the EDPB, as well as a lack of visual identity between a framework's own copy and the one provided by authorities. A more stringent approach to versioning is clearly needed across the board. We also observed an inconsistent approach to the publication of approval decisions and case numbers, and a fragmented practice regarding whether frameworks are easily and freely available to the public. These challenges underscored the necessity of a centralized, meticulously maintained resource like our new register.

This launch is just the beginning. Based on our experience, the provided information, its structure, and key fields will be continuously refined in future iterations to ensure maximum clarity and utility. We invite everyone to send additional or updated information if at hand, as we are always open to feedback to improve this resource for the benefit of the entire community.

This launch is just the beginning. Based on our experience, the provided information, its structure, and key fields will be continuously refined in future iterations to ensure maximum clarity and utility. We invite everyone to send additional or updated information if at hand, as we are always open to feedback to improve this resource for the benefit of the entire community. Just reach out!

In the coming weeks and months, we will be publishing a series of in-depth articles, each dedicated to a specific framework listed in the register. We will delve into the details of each certification and code of conduct, offering valuable insights into their scope, application, and benefits.

Explore the register and stay tuned for our upcoming posts, where we'll unpack these vital tools one by one.

The imagery and the article has been created using artificial intelligence services; here Gemini.