Im the area of self-regulation the GDPR contains 3 opening clauses:

Art. 40 I: encourage the drawing up of codes of conduct      

Art. 41 II: accreditation procedure for bodies that monitor the compliance with approved codes of conduct          

Art. 43 I: accreditation procedure for certification bodies