Guidelines 01/2019 on Codes of Conduct and Monitoring Bodies under the GDPR

Section 12.4  Established procedures and structures

70. A monitoring body will also need to have appropriate governance structures and procedures which allow it to adequately:

• assess for eligibility of controllers and processors to apply the code;

• to monitor compliance with its provisions; and

• to carry out reviews of the code’s operation.

71. Comprehensive vetting procedures should be drafted which adequately assess the eligibility of controllers and processors to sign up to and comply with the code. It should also ensure that the provisions of the code are capable of being met by the controllers and processors.

72. Procedures and structures to actively and effectively monitor compliance by members of the code will be required. These could include random or unannounced audits, annual inspections, regular reporting and the use of questionnaires. The monitoring procedures can be designed in different ways as long as they take into account factors such as the risks raised by the data processing in scope of the code, complaints received or specific incidents and the number of members of the code etc. Consideration could be given to the publication of audit reports as well as to the findings of periodic reporting from controllers and processors within the scope of the code.

73. Code owners will also need to demonstrate that the proposed monitoring body have adequate resources and staffing to carry out its tasks in an appropriate manner. Resources should be proportionate to the expected number and size of code members, as well as the complexity or degree of risk of the relevant data processing.