The Article 29 Working Party, an independent European advisory body on data protection and privacy, which is made up of the member states, has produced guidance detailing which member state’s law applies when gathering or processing data. The guidance was produced to offer clarity in relation to the Data Protection Directive 95/46/EC and the way it identified whose law applied to data processing. In particular the guidance says the Directive does not consider where a data controller is based but refers to where an establishment of that controller is based. This may prove problematic where data controllers have more than one establishment in many countries. FE and HE institutions, in their role as data controllers, may find this guidance useful and may wish to refer to the opinion at: http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2010/wp179_en.pdf.