The UNI CEI EN 17799:2024 Certification for Data Protection: let’s explore this certification and its value.
The recent UNI CEI EN 17799:2024 certification represents a new benchmark for organizations aiming to effectively manage and protect sensitive data. It is a European voluntary technical standard that offers detailed guidelines for managing privacy and personal data security, with specific reference to EU Regulation 2016/679 (GDPR).
Objectives and Advantages of Certification
The main objective of the EN 17799 standard is to provide a comprehensive framework for the protection of personal data, ensuring its confidentiality, integrity, and availability. The certification not only supports companies in complying with rigid regulations like EU Regulation 2016/679 (GDPR) but also helps to identify, manage, and mitigate cyber risks in general: it explicitly refers to the ISO 27000 standard.
Since this is a voluntary standard, what motivations might a company have for deciding to adopt it? Adopting this standard and obtaining certification can lead to relevant advantages such as:
- Increased Trust: enhances the trust of customers and partners, demonstrating a concrete commitment to the security of personal data and information.
- Competitive Advantage: differentiates the company in the market, opening a more easy access to international markets that require high security standards for privacy. In fact, although EN 17799 is inevitably only a European standard, given that it concerns the GDPR, this regulation is recognized and referenced beyond EU borders.
- Guarantee of compliance with Regulation 2026/679 which, as an EU regulation, is fully binding for member states (who may integrate it), even though EN 17799 certification, or other voluntary practice or code of conduct, does not reduce the responsibilities provided by the GDPR.
Evolution and Regulatory Context
The UNI CEI EN 17799:2024 standard (Requirements for the protection of personal data in processing) was published on April 24, 2024, and incorporates the European standard EN 17799:2023. These standards replace the previous Italian guideline UNI/PdR 43.2-2018 (Guidelines for the management of personal data in the ICT sector according to EU Regulation 679/2016 (GDPR) – Requirements for the protection and conformity assessment of personal data in the ICT sector). It can be considered that EN 17799 is also the evolution of the British standard BS 10012-2017 (Data protection – Management of personal data), although no explicit mention is made of it in the European standard.
This EN 17799 standard applies to all organizations that, as data controllers or processors, handle personal data. The objective is to provide a set of requirements that allow these organizations to effectively comply with the European regulatory framework for data protection, particularly in certifying their processes related to personal data management, carrying out processing in compliance with GDPR requirements, including protection from unauthorized access, alteration, and destruction.
Why select a supplier that has obtained this certification
The UNI CEI EN 17799:2024 standard defines the requirements for the protection of personal data in their processing. A company that is in possession of this standard proves that its activity, as a data controller or processor, complies with the European regulatory framework on personal data protection. The company has implemented processes and procedures that respect the provisions of the standard, ensuring an adequate level of protection for the data processed.
What does this mean in practice? If a company declares to be in possession of UNI CEI EN 17799:2024, it means that:
- it has implemented measures to protect personal data;
- it is committed to complying with the European regulatory framework on data protection;
- it has adopted processes and procedures compliant with the standard.
More specifically, the standard focuses on the following aspects:
- declaration relating to the personal data protection policy and assumption of responsibilities by the data controller and processor;
- registration of processing activities, with identification of the legal bases for processing, data minimization, definition of the retention period, exclusion of automated decisions;
- management of risks related to personal data security, distinct, though correlated, from risks related to the company itself;
- protection of personal data by design (privacy by design) and by default (privacy by default);
- communication to data subjects of information relating to processing and eventual receipt of their consent; satisfaction of any requests from data subjects for the exercise of their rights;
- preparation for communication to the supervisory authority and data subjects in case of data breach;
- implementation of measures for the protection of personal data, including authentication and access authorization, encryption, registration, communication security, backup, periodic testing, training, instructions, evaluation of the effectiveness of technical and organizational measures taken;
- verification of continuity and improvements through corrective actions, internal audits, periodic reports, and external maintenance and renewal audits of certifications.
Conclusions
To sum up, the UNI CEI EN 17799:2024 certification is not just a regulatory requirement, but a fundamental “passport” for companies that want to build a secure and reliable future in personal data processing.
Among the very first companies in Italy, Wondersys obtained UNI CEI EN 17799:2024 certification in June 2025, migrating from the previous UNI/PdR 43.2:2018 certification, and continues, even more so, to offer itself as a supplier that cares about safeguarding the personal data of its clients, as well as its own.
This certification complements the already existing ISO 9001:2015 and especially ISO 27001:2022 certifications, demonstrating Wondersys’ commitment to protecting information in general, not just personal data, the information system, and ensuring the maximum possible operational continuity.
