I think there was some mention of GDPR on this list last year, but I'm struggling to see how to actually search the list archive (http://mailman.ecs.soton.ac.uk/pipermail/eprints-tech/). I

 know also that this was a topic at the EPrints user group meeting within the Repository Fringe event in Edinburgh last summer - but I'm not aware of any further information emerging from that session either.

And finally - I am familiar with this page and its contents - but there are still quite a lot of items marked as "TO DO", including the section "Request a copy Dataset": https://wiki.eprints.org/w/GDPR 

My question is this: Would anyone on this list be willing to share with me what they consider the legal basis to be for processing personal data which is received when a user selects the "Request a copy" button, and fills in their contact details etc.? I realise that each institution makes a decision on which of the 6 legal bases it chooses for each of its processing activities - so I'm interested (on or off-list!) to know what colleagues think, and / or what you have stated in your privacy notices!

With many thanks in advance for considering my request   :-)

Best wishes,

Nicola 

Nicola Siminson

Institutional Repository and Records Manager

The Glasgow School of Art