Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of GDPR

Section 8.8  Preventive actions

The competent supervisory authority may specify and add furtheradditional requirements if in accordance with the national law.