Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of GDPR

Paragraph 9.3.2 Documentation of evaluation activities

Additional requirements may be formulated by the supervisory authority.