The REFEDS Data protection Code of Conduct (CoCo v2) defines an approach at a European level to meet the requirements of the European General Data Protection Regulation (GDPR) for releasing mostly harmless personal attributes to a Service Provider (SP) from an Identity Provider (IdP). For more information please see REFEDS Data Protection Code of Conduct.

The earlier GÉANT Data protection Code of Conduct (CoCo v1) defines an approach at a European level to meet the requirements of the European Union Data Protection Directive. The Data Protection Directive has been superseeded superseded by GDPR and therefore GDPR must be taken into account for CoCo v1. CoCo v1 is in the same spirit as GDPR, i.e. the Charter of Fundamental Rights of the European Union. For more information please see GEANT Data Protection Code of Conduct.

CoCo v1 will exist in parallell with CoCo v2 for an extended time and therefore we recommend all services that uses CoCo v2 to also declare CoCo v1 and the other way around.