This report focuses on personal data as an important category of restricted data, and looks in particular at the legal requirements, both current and future, on EUDAT service providers storing and processing personal data. Guidelines and recommendations for EUDAT service providers are made on the basis of the newly-agreed EU General Data Protection Regulation (GDPR). A second version of this report will extend guidelines to cover broader categories of restricted data.