In order to prepare a successful certification, here is some advice:

• Commit to personal data protection and communicate your commitment (Privacy Pact).
• Designate a Data Protection Officer and make him/her easily reachable by the public and by your National Supervisory Authority.
• Inventory and document your processing activities.
• Check the lawfulness of your data processing activity.
  (if based on consent, make sure that consent is informed, free, clearly expressed, and received before processing the data).
• Assess the risks for the rights and freedom of data subjects and, if applicable perform, a Data Protection Impact Assessment (DPIA).
• Minimise the personal data collection, processing, access and period of retention.
• Secure the data processing with appropriate technological and organisational measures.
• Adopt adequate data protection policy, rules and procedures, including for access control, backups and data retention period, data subject rights, Processor and cross-border transfer of personal data.
• Communicate your data protection policy and procedures.
• Record and document the exercise of data subjects' rights.
• Record and document any data breaches and your reaction.
• Regularly check your technical and organisational measures and update your risk assessment.
• Perform at least once a year a top management review of the internal audit results and risk assessment. The top management should adopt a specific action plan addressing the identified weaknesses.