SURF services and the GDPR
SURF is working hard to implement the GDPR within its organisation, so that its own services will comply with the regulation as well.
SURF services in accordance with the Legal Standards Framework
SURF provides several services to its members. These services must also comply with the GDPR. That is why the SURF Legal Standards Framework for (Cloud) Services is used for services for which SURF processes personal data on behalf of institutions. Services are organised in a privacy-friendly way as much as possible and solid agreements are made with the institutions and possible (additional) suppliers. The GDPR compliance of other SURF services, such as the network, is also tested. In mediation situations, SURFmarket uses the SURF Legal Standards Framework as a foundation for negotiations with suppliers.