Version 1.0, 14 June 2013

The Data protection Code of Conduct describes an approach to meet the requirements of the EU Data Protection Directive in federated identity management. The Data protection Code of Conduct defines behavioral rules for Service Providers which want to receive user attributes from the Identity Providers managed by the Home Organisations. It is expected that Home Organisations are more willing to release attributes to Service Providers who manifest conformance to the Data protection Code of Conduct.

The Data Protection Code of Conduct consists of:

• GÉANT Data Protection Code of Conduct (for Service Providers in EU/EEA and countries with adequate data protection) (pdf)
• Entity Category Specification: Data Protection Code of Conduct (for Service Providers in EU/EEA and countries with adequate protection) (pdf)
• SAML 2 Profile for the Data Protection Code of Conduct (pdf)
• non-normative, informational documents supplementing the Data Protection Code of Conduct (web page)