The SNA Quality Mark and the GDPR

21 May 2026

We are often asked by customers whether it is necessary to enter into a data processing agreement with Normec VRO for inspections and audits. This is not the case.

Normec VRO is not a data processor in the context of these activities. This is because, during an inspection or audit, we do not process personal data on behalf of clients. However, we do come into contact with personal data. In this article, we explain why a data processing agreement is not necessary in this case.

Independent Approach

It is of the utmost importance that a certification body (such as Normec VRO) reaches an independent judgment when conducting an inspection or audit. In doing so, Normec VRO applies its own methods and techniques, without interference from the client. After all, it would be strange if a client told the inspector or auditor how to reach a conclusion.

A data processing agreement contains detailed instructions on how the processor must handle the organization’s personal data. Because Normec VRO operates independently, a data processing agreement (with instructions) does not form part of the agreement between Normec VRO and its clients.

Normec VRO processes personal data for its own purposes, such as to determine whether a company complies with the requirements of NEN 4400-1 or NEN 4400-2. In this sense, Normec VRO is the data controller itself, and we are responsible for our own data processing policy and security measures during the inspection or audit. Fortunately, you do not need to worry about that. Click here for more information about the processing of personal data during an SNA inspection. SNA has updated its protocols regarding the handling of personal data during inspections. There are two protocols: one regarding personal data such as the BSN and one regarding criminal records.

Informing Employees

What is important, however, is that you inform your employees (data subjects whose personal data you store in your records, including self-employed individuals) about the potential processing of their data by a certifying body. You must specify which data may be processed, for what purpose, and by which organization. For example, the purpose of an SNA Quality Mark is to prevent fraud and the exploitation of workers. You should communicate this to your employees.

Need help with certification in your industry?

Contact our specialist

Related news articles

21 May 2026

BSN on invoices? Is that allowed under the GDPR?

The Citizen Service Number (BSN) is a personal identification number intended primarily for communication between citizens and the government. Non-governmental organizations may only use the BSN if required by law. Therefore, it must be verified whether there is a legal basis whenever the BSN is processed. In practice, our inspectors regularly observe that the BSNs of seconded employees are listed on invoices sent to the client. Is that really okay?

Standard quality control certification assurance concept, checkbox icon of guarantee

21 May 2026

Copy of ID: When is it required? And when isn’t it?

During inspections, we regularly encounter clients who—intimidated by the GDPR—no longer know when a copy of an ID must be kept on file. We also see that copies have been made illegible and/or that the Citizen Service Number (BSN) has been removed.

A man is typing and looking at his laptop while holding a paper in his hand, working at his desk.

02 May 2024

Full verification of identity documents of great importance

The Netherlands Labor Inspectorate (NLA) found many errors during inspections in 2023 in the area of establishing the identity of workers using valid identity documents. In a large number of cases, the documents were expired, forged, not valid or the identity was not recorded at all. This is according to a report by the NLA.

Man and woman in a meeting, with the woman wearing a blue top taking notes while smiling during the conversation.

21 May 2026

Meeting administrative obligations

Employers have many administrative obligations. Failure to fully comply with these administrative obligations carries risks. For example, one of the consequences may be that you have to apply the anonymous rate. In this article, we explain when an employer must apply the anonymous rate and how to process it in the payroll tax return.

28 May 2025

Important update: e-signatures

The Tax Office has returned to the recent change in the Payroll Tax Handbook 2024 (October version) on electronic signatures. Contrary to earlier reports, the advanced electronic signature (AES) remains permitted when signing declarations for payroll taxes.

21 May 2026

Fixing deviations? The 4-O System!

If, following an inspection or audit, you’ve been informed that your company does not meet the standard, you’ll have the opportunity to correct this deficiency. For example, a 3-month minor nonconformity must be sufficiently corrected within three months. If this is not the case, the 3-month “minor” nonconformity will be reclassified as a “major” nonconformity. But how can an inspector assess whether the issue has been rectified “to a sufficient degree”? To avoid disputes, the inspector applies the 4-O system. According to the 4-O system, the inspector will verify whether the deficiency has been remedied to a sufficient extent.