Type "what is gdpr compliance" into a search bar and you will land on vendor pages that say "GDPR compliant" next to a padlock icon. The phrase sounds like a status you could verify, the way you verify a SOC 2 report or an ISO 27001 certificate. It is not. The General Data Protection Regulation is an EU law, not a certifying body, and it does not issue a pass or fail label to any company. This article explains what GDPR actually requires of a vendor, why the claim has no registry behind it, and which adjacent pieces of public evidence a reviewer can check instead, such as a Data Privacy Framework listing or an ISO 27701 scope extension.
What "GDPR compliant" actually claims
When a vendor writes "GDPR compliant" on a trust page, it is making a self-assessed statement about its own data handling practices under EU law. Nobody audits that sentence before it is published. There is no accreditation body that stamps a company as meeting the regulation, the way a UKAS-accredited certification body stamps an ISO 27001 scope. A buyer reading the phrase has no way to tell whether it means "we have a data processing agreement template" or "we have run a full Article 30 records review and a data protection impact assessment". Both companies can write the same three words.
Why there is no GDPR certification to check
GDPR does include a mechanism for certification. Articles 42 and 43 allow member states and supervisory authorities to approve certification schemes and accredit certification bodies to issue them. A handful of schemes exist, such as Europrivacy, which has EU-wide recognition for specific processing activities. But these schemes are narrow, voluntary, and cover a defined scope of processing, not a company-wide "GDPR compliant" badge. No scheme functions as a single registry a buyer can search the way they can search the FedRAMP registry mirror or the Visa PCI registry mirror. The GDPR framework page lists the vendors in the index that reference this regulation, but it exists to organise claims, not to validate them, since no accredited registry does that job.
The establishment of certification mechanisms and data protection seals and marks should be encouraged, for the purpose of demonstrating compliance with this Regulation and allowing data subjects to quickly assess the level of data protection of relevant products and services.
That recital is the legal basis for certification schemes, and it is worded as encouragement, not a mandate. More than a decade after the regulation's drafting began, most vendors still rely on contractual terms and internal policy rather than a third-party certification mark.
What GDPR actually asks of a vendor
Strip away the marketing language and GDPR asks a vendor acting as a processor to do specific, checkable things: sign a data processing agreement that covers Article 28 terms, list its sub-processors, support data subject access requests, notify the controller of a breach without undue delay, and have a lawful basis for any processing it does on its own account. The regulation does not care what a vendor calls itself. It cares what the vendor does with personal data and what paperwork sits behind that. The full breakdown of these obligations by article is on the GDPR regulation page, which maps each requirement to the kind of evidence a vendor could plausibly publish.
This is also where "GDPR compliant" breaks down as a phrase. GDPR compliance is not a single state a company reaches and keeps forever, like a certificate with an expiry date stamped on it. It is a continuous set of obligations tied to specific processing activities, and it changes every time a vendor adds a new sub-processor, launches a new product, or moves data to a new region.
The Data Privacy Framework: the closest thing to a public marker
The one piece of adjacent evidence that is genuinely checkable is enrollment in the EU-US Data Privacy Framework. DPF is a different legal mechanism, it governs the transfer of personal data from the EU to the US, but a current DPF listing tells a reviewer something real: the vendor has self-certified to the US Department of Commerce, committed to the DPF Principles, and made itself subject to FTC enforcement if it misrepresents that commitment. The Data Privacy Framework explained covers how the self-certification and annual re-certification process works, and the DPF registry mirror lets a buyer check whether a specific vendor's listing is active, inactive, or has lapsed.
DPF status is not a GDPR compliance proxy on its own. It only covers international transfer, one narrow slice of the regulation. But it is public, dated, and tied to a specific enforcement body, which puts it well ahead of a bare "GDPR compliant" claim. The programme has also survived legal challenge, which the Data Privacy Framework appeal piece covers for buyers tracking the ongoing litigation.
ISO 27701: a scope extension worth checking for
ISO/IEC 27701 is a privacy information management extension to ISO 27001. It does not stand alone, a vendor needs an underlying ISO 27001 certificate first, then extends the scope to cover PII controller or PII processor obligations. A certificate that lists ISO 27701 in its scope statement is evidence of an external auditor checking privacy-specific controls against a published standard, which is a meaningfully different thing from a vendor's own marketing copy. It still is not a GDPR certificate, ISO 27701 is an international standard, not an EU legal instrument, but the control set overlaps heavily with GDPR's processor obligations around consent records, data subject rights handling, and retention limits.
A card like the one below shows how this looks when it is public. Look at whether the trust centre lists ISO 27701 as a distinct line next to ISO 27001, whether the DPF row shows an active status, and whether a subprocessor list is published alongside them, rather than treating any single badge as the whole answer.
Docebo · Trust report
Education · Public evidence as of 12 Oct 2026
Framework overview
CertReports state for each framework with public evidence: 2 verified, 9 vendor-stated.
ISO 27701Vendor-statedTrust centre · 30 Sep 2026
FedRAMPVerifiedModerate impact
DPFVerifiedValid to 30 Dec 2026
SOC 2Vendor-statedTrust centre · 30 Sep 2026
GDPRVendor-statedTrust centre · 30 Sep 2026
PCI DSSVendor-statedTrust centre · 30 Sep 2026
ISO 27001Vendor-statedTrust centre · 30 Sep 2026
ISO 27017Vendor-statedTrust centre · 30 Sep 2026
ISO 27018Vendor-statedTrust centre · 30 Sep 2026
5Documents and agreements
Legal and review documents Docebo publishes or offers, as of 30 Sep 2026.
- Standard contractual clauses · On request
- Subprocessor list · Public
- Privacy policy · Public
- AI and data use policy · Public
- Public trust centre documents · Docebo SOC2 Report Renewal Statement (Bridge letter); Docebo ISO 27001, 27701, 27017, and 27018 latest certificate; Docebo ISO 9001 Certificate
2Security practices
Public statements from Docebo, shown as statements, not attestations, as of 30 Sep 2026.
- Penetration testing · annual
- Data residency · Australia, Canada, EU, India, US
1Subprocessors
Named on Docebo's public subprocessor list, last seen 30 Sep 2026.
What a reviewer can actually check this week
- 1
Search the DPF registry
Check the vendor's entry in the DPF registry mirror for active, inactive, or lapsed status, and note the date of the last re-certification.
- 2
Read the certificate scope, not just the badge
If a vendor cites ISO 27001, check whether the scope statement also lists ISO 27701. A logo alone does not confirm this.
- 3
Open the data processing agreement
A public DPA shows the contractual terms the vendor is actually offering, including sub-processor notice periods and breach notification windows.
- 4
Check the subprocessor list
Article 28 requires disclosure of sub-processors. A dated, named list is stronger evidence than a sentence saying sub-processors are vetted.
- 5
Note what is missing
If none of the above exists, say so plainly: there is no public evidence behind the claim, rather than assuming the opposite.
| Evidence type | What it shows | What it does not show |
|---|---|---|
| DPF listing | Self-certification to US Commerce, FTC enforceable | Only covers EU-US transfer, not the rest of GDPR |
| ISO 27701 scope line | Independent audit of privacy information management controls | Not an EU legal instrument, requires an underlying ISO 27001 certificate |
| Published DPA | Contractual terms the vendor has committed to | Not independently verified by a third party |
| Subprocessor list | Transparency on who else touches the data | Does not show how those sub-processors were vetted |
| "GDPR compliant" statement alone | A marketing claim | No registry, auditor, or expiry date behind it |
None of these replace a legal reading of the vendor's role and obligations, but some are checkable and some are not.
- 0
- EU-wide registries for general GDPR compliance
- Article 42 schemes exist but cover narrow processing activities, not a company-wide badge
- 3,000+
- vendor pages tracked
- in the CertReports index on 2026-10-01
- Few
- ISO 27001 holders that also list ISO 27701
- the privacy extension is optional and most certificate scopes stop at the base standard
GDPR certified is not a real status
If a vendor writes "GDPR certified", treat it as a red flag rather than reassurance. GDPR has no certifying authority that issues that label. Ask instead for the DPA, the sub-processor list, and whichever of the DPF or ISO 27701 evidence applies.
How this differs from GDPR and CCPA, or from consent
Two other phrases get confused with GDPR compliance, and it is worth separating them before moving on. CCPA and its amendment CPRA are California state law, not EU law, and they give consumers different rights, such as the right to opt out of the sale of personal information, which GDPR does not frame the same way. A vendor can meet obligations under one without automatically meeting the other, even though the underlying privacy programme often overlaps. Consent, meanwhile, is one of six lawful bases GDPR recognises for processing personal data, not a requirement for every single use of data. A vendor that processes data under a contract or a legitimate interest basis does not need consent for that specific activity, which is why "GDPR consent" banners on websites are a narrower topic than GDPR compliance as a whole.
People also ask
What is gdpr compliance?
GDPR compliance means a company meets the obligations set out in the EU's General Data Protection Regulation for any personal data it processes, including having a lawful basis, honouring data subject rights, and managing sub-processors and breach notification correctly. It is not a certificate or a pass or fail status. There is no single registry or certifying body a buyer can check, so compliance is judged activity by activity rather than confirmed by any one document.
What is gdpr compliant?
"GDPR compliant" is a self-assessed phrase vendors use on marketing pages. It has no legal definition and no certifying authority behind it, unlike a SOC 2 report or an ISO 27001 certificate. When a vendor uses it, ask what specific evidence sits behind the claim, such as a signed data processing agreement, a published sub-processor list, or a DPF listing, rather than treating the phrase itself as proof.
What is gdpr and ccpa?
GDPR is an EU regulation covering personal data of people in the EU, with obligations like lawful basis, data subject rights, and breach notification. CCPA, amended by CPRA, is a California state law covering California residents, with its own rights such as opting out of data sales. They overlap in spirit but differ in scope, enforcement, and specific requirements, so meeting one does not automatically satisfy the other.
What is gdpr consent?
GDPR consent is one of six lawful bases a company can rely on to process personal data under the regulation. Valid consent must be freely given, specific, informed, and unambiguous, and it must be as easy to withdraw as it was to give. Many processing activities instead rely on contract performance or legitimate interest, so consent banners only apply to the subset of processing that actually depends on that basis.
Solomon Amos · Founder, CertReports
Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.
Read next on CertReports