Once a hot topic at conferences, seminars, etc. which seems to have gone away. Perhaps its been resolved to every ones satisfaction and I've missed something, but I will ask the questions anyway. Who is the Data Controller responsible for personal data obtained, processed and maybe disclosed by students in the course of their academic studies? Does it make any difference whether the data is held on a university computer, the students own or is not computerized? Lastly what about data held on university computers by students and staff which is not work related and is effectively their private data. I know they should not do it but they do. I look forward with interest to your replies. David Marsh %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%