Cloud 101

Submitting the GDPR Code of Conduct to the STAR Registry

How does the GDPR Code of Conduct integrate with the STAR program?

The STAR Program was originally designed to provide both CSPs and customers with a framework for cloud security assurance and compliance.

With the introduction of the GDPR Code of Conduct, CSA has taken a first step towards the extension of STAR to Privacy.

Security and Privacy are two foundational aspects and requirements of a trusted cloud environment, they walk hand-in-hand and mutually support each other in achieving this goal.

From the compliance perspective, security represents a key enabler of privacy, a necessary foundation that allows companies to protect personal data.

The CSA STAR Program provides:

  • Technical standards, i.e. Cloud Control Matrix (CCM) and GDPR Code of Practice
  • Certification schemes and adherence mechanisms
  • A public registry

The joint adoption of both our Security and Privacy standards and certification/attestation provides CSPs with a compliance suite for both legal and technical security requirements of GDPR.

Submitting a Self Assessment

For the submission of your Code of Conduct Self Assessment please submit the following documents through the CSA STAR Registry

The current version of the CSA Code of Practice is 3.2 (which replaces 3.1), the updates were to be in compliance and align with the Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679 adopted February 12, 2019.

The third-party certification, which will be available in Q4 2019, covers the same scope of the Self Assessment, but rather than being a self-attestation of the adherence to the requirements of the Code (and consequently of the GDPR), is based on a thorough audit performed by a qualified assessor. During the audit the qualified assessor will verify the correct implementation of CoP Requirements and the accuracy of information included in CoP Template.

CSA Code of Conduct for GDPR Compliance Trust Marks

Promoting Transparency and assurance, organizations complying with CSA Code of Conduct for GDPR Compliance can apply for an official trust mark.

CSA Code of Conduct for GDPR Compliance Declared

The “Declared” mark is given to services and/or providers that have fulfilled the self-assessment process for the CSA Code of Conduct for GDPR Compliance requirements.

CSA Code of Conduct for GDPR Compliance Certified

The “Certified” mark is given to services and/or providers which provide evidence of compliance with the CSA Code of Conduct for GDPR Compliance requirements by means of third party certification.

Submit to the STAR Registry


The industry's most powerful program for security assurance in the cloud.

Learn more

Submit to Registry

Submit to CSA’s Security, Trust, Assurance, and Risk (STAR) Registry to verify your level of privacy and security on the cloud.

Submit Now

Get the Code of Conduct

CSA Code of Conduct for GDPR Compliance provides a consistent and comprehensive framework for complying with the EU’s GDPR.

Download the Code