Certification verification: why confirm a certificate you issued?

In short

• You already hold these facts. Whoever issues a certificate keeps a record of it: who holds it, what it is called and its number. You are asked only whether the name and the number match yours.
• It protects your certificate. A certificate is worth only as much as an employer can trust it. Each confirmation shows that yours is genuine, and one you cannot match stays marked as claimed by the person, never as confirmed.
• certo asks on the holder's behalf, with their explicit consent. They started the check from their own signed-in certo account, chose your organisation and the address we wrote to, and picked each fact you are asked about.
• You do not have to answer. No law we know of obliges you to answer certo. You may decline on the same page.

What you are asked, and what not

• Asked: whether the certificate's name and its number, as the holder claimed them, match your records.
• Not asked: marks, scores or the number of attempts, how the person prepared, an opinion of them, or anything about health, family, beliefs or a criminal record.
• You send no new personal data. You tick what matches and name your team. Anything you do not tick stays marked as claimed by the person.

If you already have a register

Many issuers publish a register or a verification page where anyone can look a certificate up by its number. Answering here is the same check, made once, for one holder who asked for it. If you would rather we used your register, write to support@certo.bio.

If you issue certificates often, you can issue them on certo yourself, so a holder never has to ask: see Sending certificates to learners.

The legal basis

Confirming a certificate is processing the holder's personal data, so it needs a legal basis. Here it is the holder's own request.

• Consent of the holder (GDPR Art. 6(1)(a)). In the EU and the EEA the General Data Protection Regulation applies directly. The holder's request names your organisation and the exact facts, so it is specific and informed, and it is freely given: the holder alone decides whether to ask.
• You can prove it (GDPR Art. 7(1)). A controller relying on consent must be able to show it. certo keeps a record of every request: which account asked, when, and for which facts. Write to support@certo.bio and we send you the record for the request you received.
• Only what is needed (GDPR Art. 5(1)(c)). The request lists only the facts the holder wants confirmed, and the page lets you confirm only those.
• Outside the EU and the EEA your own data protection law applies. The holder's request, and certo's record of it, are the same wherever you are.

Certificates have no country pages. An issuer usually works across many countries, and the reason to answer is the certificate's own worth rather than a national law.

If you decline, or do not answer

Press "We do not answer these requests" and the record shows that your organisation declined. Nothing else is asked of you. If nobody answers before the request closes, the record says “no reply”, never confirmed.

This is not legal advice

This page explains why certo considers answering lawful, as the law stood on the date above. It is not legal advice for your organisation. If your legal team has a question, write to support@certo.bio.

Sources

• Regulation (EU) 2016/679, the GDPR (EUR-Lex): Articles 5(1)(c), 6(1)(a) and 7(1)