Home
/
ICANN Policy
/
Registration Data Policy

Registration Data Policy

RDP 2025 — RDAP, data redaction, privacy/proxy rules

The ICANN Registration Data Policy (RDP), effective 21 August 2025, supersedes the Temporary Specification that governed post-GDPR registration data handling since 2018. It defines what data registrars must collect, what must be published, and how third parties can access non-public data.

Minimum Public Data Set

Always public: Domain name, creation date, updated date, expiry date, registrar name, registrar IANA ID, name servers, EPP status codes.
Redactable: Registrant name, organisation, email, address, phone. May be redacted by default under GDPR/privacy law.
Organisation field: Published only with registrant consent. If published, treated as legal owner (supersedes individual name).
Admin/billing/tech: No longer required. RDP 2025 eliminates mandatory admin, billing, and technical contacts for gTLDs.

ℹ Key RDP 2025 change: Admin, billing, and technical contacts are no longer required to be collected or published. This is a significant simplification from the pre-2025 model.

Minimum vs Full Data Set (Registrar → Registry)

The RDP introduces the concept of Minimum Data Set vs Full Data Set for data transferred from registrar to registry. This is a key operational distinction for AutoDNS integrations.

Minimum Data Set: ~80% of gTLDs. Only essential registration data transferred to registry. No personal contact data beyond what is strictly necessary. Admin, tech, billing contacts NOT transferred. Registrant name, org, address, phone, email: retained by registrar only (and escrow). Registry only holds: domain name, nameservers, registrar ID, dates, status codes.
Full Data Set: ~2.5% of gTLDs. Registry requires all four contact types (registrant, admin, tech, billing). Typically sponsored or restricted TLDs with additional eligibility verification needs.
Expanded Data Set: Some TLDs require additional data beyond standard (e.g. .ASIA nexus declaration, .US nexus category, .EU citizenship). These are documented per TLD.
ccTLDs: Not subject to ICANN RDP. Country code TLDs (.de, .fr, .uk, etc.) follow their own registry-specific data policies. Some are more restrictive than RDP (e.g. .DE NIS2 phone mandatory), others less so.

ℹ Key operational impact: For Minimum Data Set TLDs, admin/tech/billing contact data will be deleted from registry systems. Only the registrar (InterNetX/AutoDNS) retains the full contact record. Customers querying RDAP at the registry level will see only registrant-level data.

Organisation Field = Legal Owner

Under RDP 2025, if the Organisation field is populated, the organisation is the legal domain owner. The individual named is recorded as a contact person within that organisation. If Organisation is blank, the individual is the legal owner. Any change to Organisation (adding, removing, or modifying) is treated as a change of ownership, triggering the COR process.

⚠ COR trigger: Adding or removing a company name from the Organisation field is now a change of ownership. This will trigger the 60-day transfer lock unless the registrant opts out before the change. Inform customers before modifying Organisation.

Legacy gTLD Data Set Classification

.COM (Verisign): MINIMUM — Thin registry. Only essential data transferred.
.NET (Verisign): MINIMUM — Thin registry. Same as .COM.
.ORG (PIR): MINIMUM — Switched to minimum data set.
.BIZ (Identity Digital): MINIMUM
.INFO (Identity Digital): MINIMUM
Identity Digital portfolio: MINIMUM — ~270 TLDs. All minimum data set.
Google Registry: MINIMUM
Radix: MINIMUM
All ccTLDs: ccTLD — Not subject to ICANN RDP. Registry-specific data policies apply. See individual TLD entries.

RDAP Protocol

Registration Data Access Protocol (RDAP) is mandatory for all gTLD registries and registrars since 2019. WHOIS port-43 sunset obligations effective 28 January 2025 (registries no longer required to maintain legacy WHOIS, though many still do).

Query format: https://rdap.verisign.com/com/v1/domain/EXAMPLE.COM (for .COM)
Port-43 WHOIS: No longer mandatory for gTLD registries since Jan 2025. May return limited or no data.
Response format: JSON (structured, machine-readable). Replaces unstructured WHOIS text.

Privacy/Proxy Services

Permitted: Privacy and proxy services are permitted under ICANN policy. Registrar must maintain actual registrant data internally.
Proxy as DA: Proxy registrant treated as Designated Agent. Must relay communications to underlying registrant.
Exceptions: .US: privacy/proxy prohibited (registry enforced). .IN: prohibited since 2025. .HK, .GR, .RO, .MX, .ES: WHOIS privacy not available. .NL: WHOIS privacy removed by SIDN.

Third-Party Access

When registrant data is redacted, registrars must provide a third-party contact mechanism (web form or email relay) so that legitimate parties can reach the registrant without exposing personal data. ICANN is developing a Standardised System for Access/Disclosure (SSAD) but it is not yet operational.