GÉANT Data Protection Code of Conduct (CoCo)

The GÉANT Data Protection Code of Conduct (CoCo) is a community-developed framework that helps Identity Providers (IdPs) and Service Providers (SPs) establish a common understanding around the use and protection of personal data exchanged through federated access management.

CoCo provides transparency about how Service Providers handle user attributes received from Identity Providers and helps support compliance with data protection legislation. By declaring adherence to CoCo, a Service Provider commits to following a recognised set of privacy and data handling practices.

Why is CoCo Important?

When users access a federated service, personal attributes may be released by their home organisation to the Service Provider. CoCo helps build trust by ensuring that participating Service Providers:

Use personal data only for legitimate purposes related to the service being provided. Collect and process only the data necessary to operate the service. Provide clear information about their privacy practices. Handle personal data responsibly and securely. Respect applicable data protection requirements.

This allows Identity Providers to make more informed decisions when releasing attributes to Service Providers.

CoCo Versions

The Code of Conduct has evolved over time, and the UK federation supports understanding of both versions:

CoCo Version 1

CoCo v1 established the original framework for Service Provider behaviour regarding the collection and processing of attributes received through federation.

For detailed information on CoCo v1, including guidance for federation participants

CoCo Version 2

CoCo v2 modernises and updates the framework to reflect current data protection requirements and federation practices.

Further information about CoCo v2, including guidance for federation participants

Further Information

If you have questions about CoCo or its use within the UK federation, please contact the the UK federation service desk.