Article 24 PDPA
Verification activities to assess the fulfilment of the certification criteria

1. The President of the Office, within the timeframe referred to in Article 18 (1), and after certification, is authorized, in order to assess the entity's compliance with the certification criteria, to carry out verification activities at the controller, processor, manufacturer, or entity that places a service or product on the market.

2. The President of the Office shall notify the entity referred to in paragraph 1 of the intention to carry out verification activities.

3. Verification activities shall be carried out no earlier than after the expiration of 7 days and no later than before the expiration of 30 days from the date of delivery to the entity referred to in paragraph 1 of a notice of intent to carry them out. If the checking activities are not carried out within 30 days from the date of service of the notice, carrying them out requires a new notice.

4. Verification activities are carried out on the basis of a named authorization issued by the President of the Authority, which includes:

1) the name of the person carrying out the verification activities;

2) the designation of the controller, processor, manufacturer, or entity that markets the service or product;

3) indication of the legal basis for carrying out verification activities;

4) the scope of verification activities;

5) the date and place of its issuance;

6) signature of the person authorized to issue the authorization on behalf of the President of the Authority.