...

For REFEDS Research and Scholarship there is no formal requirement that the service shall publish a public Privacy Policy. However it's recommended that all services that are registered in SWAMID have a Privacy Policy to inform end users about how personal data are processed. SWAMID have published a Service Provider Privacy Policy Template for GÉANT Data Protection Code of Conduct that can be used except for the last section. It's also recommended that the link to the Privacy Policy is published as a web page and included in the metadata for the Service Provider.

Expected attribute release from an Identity Provider

...

• URL beginning with https to the service logotype for use in Identity Providers login pages and Discovery Services.
• URL to a web page with the service privacy policy in English and maybe Swedish.
• URL to a informational web page that describes the service in English and probably in Swedish.
• URL to a web page with the service privacy policy in English and probably Swedish, a privacy policy example template: SWAMID Service Provider Privacy Policy Template. Please remove the section about GÉANT Dataprotection Code of Conduct if you use the Privacy Policy Tamplate.

Besides the formal requirements and recommendations of REFEDS R&S it is highly recommended that the service also adheres to the REFEDS Security Incident Response Trust Framework for Federated Identity (Sirtfi).

...