Abstract
Benefits arising from initiatives to streamline the user experience for academic researchers and students must be balanced against GDPR and information security measures that institutions must take to protect their members’ personal data. Using the example of Bath Spa University Library’s role in single sign-on projects in collaboration with the IT department and a third-party software supplier, a way in which academic libraries can more robustly enter the conversation surrounding user privacy is suggested. Identity and access management is one area of collaboration in which the librarian’s traditional commitment to patron or user privacy can be upheld.