CASD is a research data center which provides secure access for research purposes to individual and personal microdata collected by several data producers mainly from the Official Statistical System. To help organisations manage personal data in compliance with citizen’s expectations and legal and regulatory requirements, a new certification based on the ISO 27701 norm was issued in August 2019, taking into account the provisions of GDPR. The presentation will extensively describe the approach needed to implement an auditable and certifiable personal data policy. Statistical organisations could also be interested in adopting this approach to strengthen their position related to GDPR.