Shaping DPP service providers: Building a secure and flexible framework

Executive summary

The Delegated Act on rules for DPP service providers presents a critical opportunity to establish a framework that is both effective and pragmatic. Open and constructive dialogue with industry will key moving forward to shape a framework that meets regulatory goals, reduces administrative burdens for all actors, and guarantees the safety and integrity of the DPP system.

As the Commission defines the Delegated Act, we recommend the following:

• Ensure key principles like data security, confidentiality, and technological neutrality are embedded in the legal text, with a thorough assessment of economic, competitive, and environmental impacts of mandatory third-party DPP services and infrastructure;
• Clarify the definition of “independent” DPP service providers under the ESPR, to ensure legal consistency and secure DPP system continuity for third-party back-up copies;
• Clarify that economic operators can authorise one DPP service provider for both primary DPP services and for back-up storage;
• Establish a common, EU-wide certification scheme for back-up services by DPP providers to fulfil the requirements of Article 10 (4) of the ESPR. Certification will ensure data security Economic operators that make DPPs available by themselves should be exempted from any certification need.