# Code of Conduct -- SaaS Industry Data Protection Code

**Sponsoring Association**: European SaaS Providers Alliance (ESPA)
**Version**: 1.0
**Submission Date**: 2026-02-01
**Supervisory Authority**: Irish Data Protection Commission (DPC)

---

## Scope

This code applies to SaaS providers established in the EU that process personal data on behalf of their customers (controllers). It covers Art. 40(2) subjects relevant to the SaaS sector.

## Covered Subjects

| Art. 40(2) Subject | Covered | Section Reference |
|--------------------|---------|--------------------|
| (a) Fair and transparent processing | Yes | Section 3 |
| (b) Legitimate interests | Yes | Section 4 |
| (c) Data collection | Yes | Section 5 |
| (d) Pseudonymisation | Yes | Section 6 |
| (e) Public and data subject information | Yes | Section 7 |
| (f) Data subject rights | Yes | Section 8 |
| (g) Children protection | Yes | Section 9 |
| (h) Technical and organisational measures | Yes | Section 10 |
| (i) Breach notification | Yes | Section 11 |
| (j) International transfers | Yes | Section 12 |
| (k) Dispute resolution | Yes | Section 13 |

## Monitoring Body

| Detail | Information |
|--------|------------|
| Body | TrustArc Europe GmbH |
| Accreditation | Accredited by Irish DPC under Art. 41 |
| Independence | Confirmed through conflict of interest declaration and structural separation |
| Reporting | Annual compliance report to DPC |

## Adherence

SaaS providers may adhere to this code by: (1) submitting an adherence application to ESPA, (2) undergoing initial assessment by TrustArc Europe, (3) receiving adherence certification valid for 3 years, and (4) participating in annual monitoring reviews.

**Prepared by**: ESPA Legal Committee