Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of GDPR

Section 7.9  Surveillance

In addition to points 7.9.1, 7.9.2 and 7.9.3 of ISO/IEC 17065/2012, and according to Article 43(2)(c) GDPR, it should be required that regular monitoring measures are obligatory to maintain certification during the monitoring period.