Abstract: With the development of personal information protection, the need for data protection certification has become increasingly prominent. Valuable lessons can be learned from data protection certification mechanisms introduced by the General Data Protection Regulation (the GDPR) along with their practices. This article investigates and analyzes the framework of GDPR certification, including its legal basis, purpose, and the distribution of roles in data protection certification mechanisms. The article then sorts out the certification and accreditation mechanisms under 42&43 GDPR, summarizes the progress of GDPR certification, and discusses aspects of the data protection certification mechanisms which need to be further specified. Based on the above analysis, the article unifies China’s actual situation of personal information protection and puts forward suggestions for researching and establishing the personal information protection certification system.

Key words: GDPR, EU, certification, accreditation, data protection

摘要： 随着个人信息保护工作的推进，相关认证需求日益凸显。欧盟《通用数据保护条例》（GDPR）提出的数据保护认证制度和相关实践可提供重要参考。论文研究分析了GDPR认证制度框架，包括认证制度的法律依据、作用、相关角色等，梳理其认证机制和认可机制，总结了认证制度的进展情况和仍需研究明确的主要问题。基于上述分析，论文结合我国个人信息保护工作实际情况，提出了研究建立个人信息保护认证体系的建议。

关键词: 通用数据保护条例, 欧盟, 认证, 认可, 数据保护