CSA CoC for GDPR Compliance
The CoC helps cloud service providers (CSPs) determine the level of protection they are required to provide and offers cloud customers a tool to evaluate the level of personal data protection offered by a CSP.
What is the CSA Code of Conduct for GDPR Compliance?
No matter whether you are an enterprise Data Protection Officer using cloud services or a Cloud Service Provider, the CSA Code of Conduct for GDPR Compliance provides a consistent and comprehensive framework for complying with the EU’s GDPR. The CSA Code of Conduct is designed to offer both a compliance tool for GDPR compliance and transparency guidelines regarding the level of data protection offered by the Cloud Service Provider.
Watch the Video
The Code of Conduct for GDPR Compliance provides:
- Flexibility: Can be applied to any cloud delivery model - IaaS/PaaS/SaaS
- Transparency: Provides cloud customers with clear understanding and transparent view of what Cloud Service Provider is doing
- Rigor: The CSA CoC provides a rigorous and proven template to adhere to GDPR privacy requirements
- Utility: Cloud customers of any size can use this tool to evaluate the level of personal data protection offered by different CSPs (and thus to support informed decisions)
- Completeness: Enables CSPs of any size and geographic location with guidance to comply with European Union (EU) personal data protection legislation and to disclose the level of personal data protection they offer to customers.
CoC for Cloud Service Providers:
- Shows adherence to GDPR privacy requirements
- Streamlines contracting, accelerates sales cycles
- Provides assurance to cloud customer of data privacy in conjunction with CSA STAR
- Applies to CSP as Data Processor and as Data Controller
- Demonstrates full compliance by connecting legal to technical requirements through combination of Code of Conduct and CSA STAR Level 1 and 2
CoC for Enterprises:
- Streamlines contracting
- Reduces time needed for internal legal review
- Highlights topics and contracting terms for internal discussion and external negotiation to make informed decisions
- Provides enterprise legal teams with established framework for GDPR compliance when contracting for cloud services
Assessing your organization's cloud services to the CSA Code of Conduct
The CSA has defined two approaches for adhering to its Code of Conduct:
A Self Assessment (Currently Available)
The Code of Conduct Self Assessment consists of the voluntary publication on a public registry, the CSA Security, Assurance and Transparency Registry (CSA STAR) of two documents:
- Self Assessment Statement of Adherence and
- Self Assessment results based on the PLA Code of Practice (CoP) Template - Annex 1
The Self Assessment covers compliance to GDPR of the service(s) offered by a CSP. A submission fee of €1495 euros is required to facilitate the publication. After publication, the company will receive authorized use of a Compliance Mark, valid for 1 year. The Self Assessment shall be revised every time there is a change to the company policies or practices related to the service under assessment. Requirements of the Code (and consequently of the GDPR), is based on a thorough audit performed by a qualified assessor. During the audit the qualified assessor will verify the correct implementation of CoP Requirements and the accuracy of information included in CoP Template.
Third party audit-based certification (Available Q4 2023)
The third-party certification, which will be available in Q4 2023, covers the same scope of the Self Assessment, but rather than being a self-attestation of the adherence to the organizations can use the resource center to stay informed. Whether you’re a cloud service provider or an enterprise, leverage the resource center to access information, tools and guidance and improve your privacy posture on an ongoing basis.
Learn About STAR
"I think the CSA Code of Conduct for GDPR Compliance is a very helpful document, both for potential customers of CSPs and for CSPs themselves.
By following closely the WP29 Opinion it ensures that both parties understand the obligations under EU law – probably the strictest requirements they will have to comply with.
Hopefully, it will be accepted by CSPs that, if they want to be viewed as acceptable service providers – especially by EU-based organizations – they are going to have to be able to answer successfully the questionnaire that is annexed to the document.”
Billy Hawkes
Former Irish Data Protection Commissioner