Submitting the GDPR Code of Conduct to the STAR Registry
How does the GDPR Code of Conduct integrate with the STAR program?
The STAR Program was originally designed to provide both CSPs and customers with a framework for cloud security assurance and compliance.
With the introduction of the GDPR Code of Conduct, CSA has taken a first step towards the extension of STAR to Privacy.
Security and Privacy are two foundational aspects and requirements of a trusted cloud environment, they walk hand-in-hand and mutually support each other in achieving this goal.
From the compliance perspective, security represents a key enabler of privacy, a necessary foundation that allows companies to protect personal data.
The CSA STAR Program provides:
- Technical standards, i.e. Cloud Control Matrix (CCM) and GDPR Code of Practice
- Certification schemes and adherence mechanisms
- A public registry
The joint adoption of both our Security and Privacy standards and certification/attestation provides CSPs with a compliance suite for both legal and technical security requirements of GDPR.
Submitting a Self Assessment
For the submission of your Code of Conduct Self Assessment please submit the following documents through the CSA STAR Registry
The third-party certification, which will be available in Q4 2023, covers the same scope of the Self Assessment, but rather than being a self-attestation of the adherence to the requirements of the Code (and consequently of the GDPR), is based on a thorough audit performed by a qualified assessor. During the audit the qualified assessor will verify the correct implementation of CoP Requirements and the accuracy of information included in CoP Template.
CSA Code of Conduct for GDPR Compliance Trust Marks
Promoting Transparency and assurance, organizations complying with CSA Code of Conduct for GDPR Compliance can apply for an official trust mark.
CSA Code of Conduct for GDPR Compliance Declared
The “Declared” mark is given to services and/or providers that have fulfilled the self-assessment process for the CSA Code of Conduct for GDPR Compliance requirements.
CSA Code of Conduct for GDPR Compliance Certified
The “Certified” mark is given to services and/or providers which provide evidence of compliance with the CSA Code of Conduct for GDPR Compliance requirements by means of third party certification.