Guidelines 01/2019 on Codes of Conduct and Monitoring Bodies under the GDPR

Section 8.3  Cooperation

51. The CompSA will issue a notification updating all SAs of the position, identifying concerned SAs and they will make a request seeking, on a voluntary basis, a maximum of two co-reviewers to assist with the substantive assessment of the draft code. The appointment of co-reviewers will be made on a first come basis. The role of co-reviewers will be to assist the CompSA in assessing the draft code. Once the co-reviewers are confirmed, comments from them on the content of the code should be provided within thirty days from their confirmation as co-reviewers. These comments will then be considered by the CompSA when carrying out its assessment for approval. As per Article 40 (7) of the GDPR, the CompSA will make the final determination as to whether the draft decision should be submitted to the Board as per Articles 63 and 64 of the GDPR.

52. The CompSA should aim to arrive at a decision within a reasonable period of time, and it should keep the code owners regularly updated on the progress and indicative timelines. Its hould outline the basis for its decision (to refuse or to approve a code) in line with the general grounds for approval and communicate that decision in a timely manner to the code owners.