Update Policy on Data Protection for GDPR

• David Kelsey (STFC)

The aim of today's discussion is to decide the overall approach for updating this policy from pre-GDPR days. The scope is Personal Data contained within the "operations" data (logs, accounting data, audit files) stored and processed at each Resource Centre. This policy does not address Privacy, Data Protection, GDPR etc related to personal data stored by and within the Research Data for any Research Community. Do we maintain the same overall approach? Or do we aim for a completely new approach? Which entities are Data Controllers? Do we have any Data Processors?