The F10 contains names, addresses, phone numbers and email addresses of duty holders and is posted visibibly on a notice board in a site office. How will this now be affected or controlled under new GDPR regs?

Firstly, the email address are usually work email and address company address, which are our professinoal identities anyway.

We have to remember that the spirit of GDPR is intended for all the banks, insurance companies, googles and amazons of this world who were selling our information and using it to bombard us with marketing relating to a recent purchase: "Just brought a car, how about some insurance/shampoo/ breakdown cover, etc."

Therefore, GDPR is about how companies are using the information. It is just a clarification of the Data Protection act. As it has been allowed under DPA 1998, I don't expect anything to change.

As already stated as the F10 is a legal requirement GDPR does not apply. The other reason for this is it is public facing business information e.g. work telephone and email etc.

If there was "personal" information contained to prevent marketing etc. GDPR would come into play and this is when, at the concept of your project, you would complete a Data Protection Impact Assessment (DPIA), which is a must under GDPR.

Essentially as already stated above it is those organisations, e.g. banks and Human Resources style functions which handle personal information which are most affected by the changes.

I hope that helps.