Updating the Data Trust Registry
In April, we announced the successful exit from pilot stage of DTI’s Data Trust Registry, and shared that we would be taking feedback from stakeholders to improve the experience and effectiveness of the Registry. We subsequently formed a working group, offered a series of issues for consideration in this working group, and developed several changes to DTR over a series of meetings and asynchronous communications. In this update, I’m sharing more on that process and the changes that resulted, highlighted by further articulations regarding third-party security audits for Trust Level 2 qualification. We believe the changes we are making improve the experience of the Registry for applicants, removing unnecessary questions and increasing clarity without undermining the high standards necessary for durable trust.
The working group we convened included a mix of stakeholders currently working with us on the Registry and others who we work with on portability generally but not the Registry. Large and small companies were represented, with a focus on product and technical individuals. We held three realtime discussions from July through the first of October. The issues, discussion notes, and resulting working group decisions were maintained in a shared document available to all participants during and in between meetings.
The updates we settled on fall into three categories:
- Administration and documentation, including changes to the information submitted by an applicant for security reporting and contact information; changes to status and information signals reported out by the API, such as the addition of “paused” to the trustStatus signal indicating temporary suspension of validity; and several small improvements to the instructions for internal reviewers.
- Removed or moved requirements, such as the TL1 application no longer requiring an affirmation of “secure transport” (redundant with HTTPS requirements), and moving some questions from the TL2 application checklist to the interview script as they were useful in providing context to an application only and in practice not hard requirements for approval. An example of the latter is the checklist’s former question regarding the applicant’s presence in other registries; the presence of a service in, for example, the EU’s Data Intermediaries Register is useful knowledge for DTI as to the nature of the service and the potential overlap between the DTR and other Registries.
- Third-party security audit expectations to articulate additional specific options for applicants.
This third change, on security audits, added to our submission guide that we accept SOC/2, ISO27001, or a combination of the App Defense Alliance’s CASA and “Cloud App/Config” standards as sufficient for Trust Level 2. Prior to this change, we had identified SOC/2 as an acceptable solution while keeping the door open for alternatives; this clarification provides affirmative signals to applicants regarding our expectations. We sought to provide a range of audit options, recognizing that applicants may pursue different types of audits for different reasons.
Before making these changes, we went back to our Trust Model, released in November 2024, which serves as the intellectual grounding for the Data Trust Registry. We examined our five core criteria for trust in the transfer of personal data: transfer party authentication, jurisdiction, data security, transparency; and end-user authentication and authorization. We believe that this aligns our requirements and policies even more closely with the trust model, making sure that each requirement is justified as a legitimate and effective measure. The result is to reduce burdens on registry applicants while maintaining high standards and good outcomes.
We have also been careful not to make these changes in a vacuum. In addition to the working group, we have also gathered input from DTR applicants through a survey and countless conversations, and through ongoing dialogue with key regulatory stakeholders such as the UK Government and the European Commission, with respect to implementation of Article 6(9) of the Digital Markets Act (DMA). On that front, we are delighted the DMA team recognises the potential value the DTR can offer through effective and streamlined review:
“Our exchanges with DTI on the DTR review process show that it constitutes an effective route for companies to demonstrate that they are suitable to integrate data portability solutions. We also welcome the increased flexibility to meet the security requirement for Trust Level 2. We see value in a centralised review process that could ultimately act as a single door to the data portability tools of several data providers (rather than having to undergo a separate process for each different provider), making it more effective for companies to integrate with these various tools. We expect that this, in turn, will serve as a vessel to foster more competitivity and fairness in digital markets as more companies join the DTR both on the provider and recipient side. ”
Antoine Babinet, Deputy Head of Unit - DMA Enforcement
Key elements of the application process remain unchanged, including our formula of checklist and interview for Trust Level 2, and one-year renewals at all trust levels, a process we are beginning now for our earliest applicants. While this working group cycle has concluded, we plan to evaluate our policies and practices regularly over time, and always welcome feedback and suggestions.
We invite you to check out the registry, to apply for inclusion, to review our API guide, and – last but not least – to reach out to us to explore working together and integrating DTR signals into your use cases.