ACCREDITED
CERTIFICATION
BODY
ACCREDIA.

Inveo
Certification

We are a certification body accredited by Accredia (Accreditation body designated by the Italian government under Reg. 765/2008/EC) in the field of data protection activities, against the ISO/IEC 17065:2012 standard.
Accredited for voluntary, and unregulated, certification of compliance with applicable regulations, including GDPR, for ISDP©10003 (GDPR compliance assessment) and SGCMF©10002 certification schemes - compliance of pharmaceutical companies' health care professionals' records with the combined provisions of EU Reg. 2016/679 and 219/06.

The independence and expertise gained by our Lead auditors in the field, coupled with the establishment of procedures for issuing, reviewing and withdrawing certifications as well as facilities for handling complaints related to certification violations, enable INVEO CERTIFICATION to position itself as a state-of-the-art certification body.

BENEFITS

ACCREDIA through accreditation therefore ensures that they are complied with:

IMPARTIALITY

Representation of all stakeholders within the body

INDEPENDENCE

GDPR auditors and certification/reporting committees ensure that there are no conflicts of interest with the company to be certified

CORRECTNESS

Ensure that the activities of separate legal entities with which Inveo has relations, does not compromise the impartiality of its activities

COMPETENCE

Accreditation primarily certifies that the personnel engaged in verification activities are culturally, technically and professionally qualified.
Certification is an Accountability tool. The entry into force of EU Reg. 679/2016, revolutionized the concept of "Accountability" (Accountability) of the Data Controller (art.5.2) by providing the latter with new and valuable tools to support the demonstration of compliance with the regulation (art.24).
Certification is a tool to measure yourself, to optimize your internal management system and privacy system, and to demonstrate that you have become aware of your "level of personal data governance" and have implemented technical and organizational measures to comply with current data protection regulations.

WHAT IS CERTIFICATION?

Certification (Article 42 of the GDPR) is a voluntary tool for assessing and demonstrating one's compliance with the European regulation on the processing of personal data.
Article 42 identifies the obvious task that the GDPR places on member states, supervisory authorities, the committee and the commission to "encourage" the use of certification mechanisms.

Certification does not absolve controllers and supervisors from their GDPR obligations, but it is a safeguard to the data subject on compliance with processing and a mitigating factor in the event of any sanctions.

Why should I certify myself?

Because Data Controllers and/or Processors within certified products/processes and services substantiate assurances to themselves, the market and regulators.

The certification shows that the owner or responsible:
Work according to standard
Demonstrates Accountability
Demonstrates to the Supervisory Authorities that it has voluntarily performed an act of due diligence
Has safe, documented and standardized procedures.
Ensures confidence of stakeholders.
Image

WHAT CAN I CERTIFY?

All processes of processing of personal data that the owner and manager carry out as part of the products, processes and services, made or otherwise provided, subject to the regulation of national and European privacy standards.
MANAGEMENT SOFTWARE • ENTERPRISE PRIVACY MANAGEMENT PROCESSES • DATABASES • WEB PORTALS • VIDEO SURVEILLANCE TOOLS

WHAT TYPES
OF CERTIFICATIONS?

Aspecific Certifications

Certification schemes that (ISO 9001, ISO 25024, ISO 27001, ISO 27018, etc.) are based on international standardization standards. We can call them non-specific, precisely because of their partiality of coverage and type of accreditation required.

In any case, they represent a "best practice" for demonstrating compliance with individual processes called out by the GDPR.

Specific Certifications

Certification schemes defined from the set of provisions (articles and recitals) of the GDPR and following the obligation of certification for products, processes and services (ISO/IEC 17065).

So they are certifications that incorporate all the controls required even by the particular areas covered by the aspecific certification standards.

INVEO CERTIFICATIONS

Certificazione 10003

GDPR Certification ISDP©10003

Created to meet the rules operational since 2018 and born out of the need to assess compliance with the GDPR. The ISDP©10003 scheme is applicable to all owners and managers within the products, processes and services, implemented or otherwise provided that want to demonstrate their Accountability and specifies the requirements for the management in fairness, security and compliance of personal data of natural persons with regard to the processing of personal data and the free movement of the same.

The outline provides principles and lines of control for a comprehensive assessment of GDPR compliance of the owner's or manager's internal processes regarding the protection of personal data with particular reference to the proper management of risks.
SEE DETAILS
Certificazione Sperimentazioni cliniche

Certification of processes for handling personal data in clinical trials

The scheme stems from the need to protect the personal data of all those subjects who participate in clinical trials, aimed at discovering the effects of drugs and their adverse reactions. Indeed, in some cases, given the distance of the subjects outside the company, the circulation of information and biological samples can be quite complex and insecure.
SEE DETAILS
Certificazione 10002

SGCMF©10002 Pharmaceutical Certification

SGCMF©10002 is a scheme aimed at assessing the compliance of the records of health care professionals visited by pharmaceutical companies with the combined provisions of 219/06 regulating the advertising of medicines and current data protection regulations.
SEE DETAILS
Certificazione farmindustria

Farmindustria code of ethics certification

The certification aims to ensure that the system implemented by pharmaceutical companies complies with the requirements defined by the regulations and the Code. The scheme is not limited to compliance with the Code of Ethics, but obliges pharmaceutical companies to operate in full transparency and according to behavioral norms.
SEE DETAILS
Would you like to get clarification on the most suitable certification path for your company?
CONTACTS
Magazine
Trattamenti a rischio. Inveo lancia il nuovo Risk Management Tool per il calcolo e la gestione del rischio

Risk Management Tool: nuovo strumento di calcolo del rischio disponibile sul Privacy Tools di Inveo

Roma, 29 settembre 2025 – Inveo group annuncia il lancio del nuovo modello di calcolo del rischio per i trattamenti di dati personali, disponibile gratuitamente a partire da oggi nella sezione Privacy Tools del sito ufficiale Inveo: Risk Management Tool.
Magazine
Certificare il rischio. ISDP©10003: la nuova grammatica della privacy

La certificazione GDPR non è più un’opzione decorativa: è la prova concreta che un titolare o un responsabile, sa trattare i dati personali con metodo, trasparenza e controllo.

La certificazione GDPR è oggi uno degli strumenti più efficaci per tradurre principi astratti in garanzie verificabili: non solo un timbro, ma un linguaggio condiviso tra imprese, autorità e cittadini.
Magazine
Esplorando il concetto di 'Rischio accettabile' o RaT: accettare o valutare?

Cosa rappresenta concretamente il 'rischio accettabile'? È quel punto di equilibrio, quel livello di rischio che un titolare, dopo un'attenta analisi, decide di tollerare, tenendo conto dei costi e dei benefici delle eventuali azioni correttive.

Ma perché è così importante?
Magazine
Decifrando il GDPR: Guida alla Valutazione del Rischio d'Impatto

Nel vasto panorama del Regolamento Generale sulla Protezione dei Dati (GDPR), spesso un dettaglio prezioso sfugge: l'importanza della frase "in particolare" nell'articolo 35. È qui che l'arte di valutare e mitigare i rischi d'impatto si trasforma in un'azione precisa.
Magazine
Un solo DPO per molte organizzazioni: idea audace o ostacolo insormontabile?

Il GDPR offre alle aziende la possibilità di nominare un singolo Responsabile della Protezione dei Dati (DPO) per tutto un gruppo o più entità pubbliche. Ma questa scelta, sebbene promettente in termini di coerenza e risparmio di risorse, è tutt'altro che semplice.
Durante le frenetiche fasi di audit per la conformità GDPR, la domanda diventa centrale e spesso scatena un vero e proprio terremoto.
Cosa può fare un auditor in questa situazione?
Magazine
ROI. Se adeguarsi al GDPR fosse un guadagno?

E' innegabile, le organizzazioni considerano il GDPR un semplice obbligo, un costo ulteriore da sopportare.
Ma se provassimo a cambiare paradigma?
Adeguarsi al GDPR può diventare un guadagno economico?

Magazine
EN 17740. L'evoluzione della UNI 11697, cosa bolle in pentola per i DPO?

Sarà pubblicata a breve, anche da UNI, la norma EN 17740:2023.
Perchè è importante questa norma?
Perchè svolge un ruolo cruciale nel plasmare il panorama professionale in questo settore, aprendo la strada a una forza lavoro più standardizzata e competente.
Magazine
Monitoraggio dell'efficacia nel trattamento dei dati. Tempi e regole

In ottica di accountability, ogni quanto tempo è necessario effettuare aggiornamenti delle misure tecniche e organizzative?
Il tempo è solo una delle dimensioni da considerare.
L'efficacia del monitoraggio non è misurata solo in mesi o trimestri, ma nella sua capacità di rispondere dinamicamente alla natura dei dati, alle loro implicazioni sensibili e alle specifiche minacce che potrebbero metterli in pericolo.