Dear EPDP Team, In reviewing outstanding items for the Initial Report, no volunteers came forward to draft text for Charter Questions k2, l4 and m4 regarding responsibilities in processing data. Accordingly, Support Staff drafted the following proposed text: k) ICANN's responsibilities in processing data k2) In addition to any specific duties ICANN may have as data controller, what other obligations should be noted by this EPDP Team, including any duties to registrants that are unique and specific to ICANN’s role as the administrator of policies and contracts governing gTLD domain names? l) Registrar's responsibilities in processing data do registrars undertake solely at ICANN's direction? l4) What are the registrar's responsibilities to the data subject with respect to data processing activities that are under ICANN’s control? m) Registry's responsibilities in processing data m4) What are the registry's responsibilities to the data subject based on the above? Proposed response: The EPDP Team took note of the GDPR requirements and notes that in instances where the EPDP Team has classified ICANN as a Controller, ICANN would be expected to comply with the law. However, the EPDP Team is not recommending additional requirements for ICANN at this time. Similarly, the EPDP Team took note of the GDPR requirements and notes that in instances where the EPDP Team has classified Registries and Registrars as Controllers, or Processors, the Registry and/or Registrar would be expected to comply with the law. However, the EPDP Team is not recommending additional requirements for contracted parties at this time. -- The draft text is also attached for ease of marking up. Please let us know if you have any concerns with the above. Best regards, Marika, Berry and Caitlin