Thank you all for your responses,

I tend to agree that the GDPR will require the appointed DPO to report to an executive member as their line manager, although it seems as though differences in organisational structures mean this will have different implications (some will need no change, others might require a new role, which I think we will).

I also think that (at least for now) I will suggest SARs being handled by the DPO – although we don’t have a large team dealing with info governance here.

The guidance from the A29WP released before Christmas could have been a bit clearer!

Thanks again,

Dan Palmer-Dunk

Information Compliance Officer

University of Hull

All archives of messages are stored permanently and are available to the world wide web community at large at http://www.jiscmail.ac.uk/lists/data-protection.html

Selected commands (the command has been filled in below in the body of the email if you are receiving emails in HTML format):

Leaving this list: send leave data-protection to [log in to unmask]
Suspending emails from all JISCMail lists: send SET * NOMAIL to [log in to unmask]
To receive emails from this list in text format: send SET data-protection NOHTML to [log in to unmask]
To receive emails from this list in HTML format: send SET data-protection HTML to [log in to unmask]

All user commands can be found at http://www.jiscmail.ac.uk/help/commandref.htm and are sent in the body of an otherwise blank email to [log in to unmask]

Any queries about sending or receiving messages please send to the list owner [log in to unmask]

(Please send all commands to [log in to unmask] not the list or the moderators, and all requests for technical help to [log in to unmask], the general office helpline)