§ 39 BDSG
Accreditation
(1)The conferral of the authority to act as a certification body pursuant to Article 43 Subsection (1), first sentence, of Regulation (EU) 2016/679 shall be carried out by the supervisory authority of the Federation or of the Länder competent for the supervision of the certification body under data protection law, on the basis of accreditation by the German Accreditation Body. Section 2 Subsection (3), second sentence, Section 4 Subsection (3) and Section 10 Subsection (1), first sentence, No. 3 of the Accreditation Body Act shall apply with the proviso that data protection is deemed to be a field falling within the scope of Section 1 Subsection (2), second sentence.