Personal Certificates and Personal Data Protection

Certificate authorities issue personal electronic certificates to users on request. Certificates contain personal data provided by the user either directly or through their home organization (attributes provided through an IdP). Once issued the certificate is delivered to the user and from that moment on further use of the certificate and distribution of data contained therein is under the user’s control. The CA does not publish details used to issue personal certificates and neither does it make these details available to third parties. The CA stores details of the personal certificate and the user for the purpose of an internal audit carried out in accordance with set procedure.

CESNET provides PKI services both on its own (CESNET CA) and in cooperation with other partners of the pan-European GÉANT Trusted Certificate Service project (TCS), wherein the service is currently being provided by the DigiCert Company. All CAs are obliged to follow Certificate Policies (CP) and Certificate Practice Statements (CPS).

• CESNET CA Certificate Policy and Certificate Practice Statement
• Sectigo Certificate Policy
• TCS Certificate Practice Statement

Personal data are being processed on request by the user and for the legitimate interest of the Certificate Authority service.

Additional information on personal data protection is available at CESNET’s home page.