GDPR Frequently Asked Questions

Everyone who engages in, or provides support services to anyone who engages in, any activity related to “controlling” or “processing” personal data of GDPR-covered individuals must be involved in GDPR compliance efforts. These efforts include evaluating data and its use on campus and designing/implementing compliance policies, procedures, and best practices. Some examples of such departments include, but certainly are not limited to:

1. Enrollment, admissions, and/or marketing departments may be involved in collecting and otherwise using personal data in soliciting or accepting expressions of interest and/or application materials from prospective students located in the EU.
2. Similarly, human resources departments are likely doing the same with personal data of prospective employees located in the EU.
3. Alumni organizations are likely collecting or otherwise using personal data of graduates who reside in, or have relocated to, the EU.
4. Academic departments are likely collecting or otherwise using personal data of its members who may be permanently or temporarily located in the EU (ex: study abroad or international program faculty), or other academic colleagues located in the EU (ex: research associates, etc.)
5. Distance learning departments are likely collecting or otherwise using personal data of online students located in the EU and/or faculty located in the EU who are teaching online courses.
6. Finance departments are likely collecting or otherwise using personal data of individuals located in the EU for billing, collection, or procurement/contracting purposes.
7. Information technology departments will have responsibility for security and data breach policies, procedures, and best practices, and for assisting other university departments with planning and implementing changes to their relevant data management systems for GDPR compliance purposes.

Members of the European Union include:

[1] Although the United Kingdom is exiting the European Union, it is still going to participate with the GDPR.

[2] Although these three countries are not part of the European Union, they have opted in to be covered under the Global Data Protection Regulation (GDPR).