Guidelines 01/2019 on Codes of Conduct and Monitoring Bodies under the GDPR

Section 12.3  Expertise

69. The code owners will need to be able to demonstrate that the monitoring body has the requisite level of expertise to carry out its role in an effective manner. As such, the submission will need to include details as to the knowledge and experience of the body in respect of data protection law as well as of the particular sector or processing activity. For example, being able to point to previous experience of acting in a monitoring capacity for a particular sector may assist in meeting this requirement. Furthermore, an in-depth understanding of data protection issues and expert knowledge of the specific processing activities which are the subject matter of the code will be welcomed. The staff of the proposed monitoring body should also have appropriate operational experience and training for carrying out the monitoring of compliance such as in the field of auditing, monitoring, or quality assurance activities.