General Data Protection Regulation (GDPR)
Data protection is everybody's business. As an educator, you will hold what is considered personal or sensitive data about your students, research subjects and maybe your colleagues and other members of your institution. The GDPR regulations require you to conform to certain rules and standards for how you collect, store and use this data.
Personal data is information that can help identify a person or their family, such as name, official identification numbers, address and other contact details.
Sensitive data goes a step further to include information that might be considered private or confidential, such as religious beliefs, health, biometrics, sexuality.
According to the Information Commissioner's Office (the independent authority in the UK providing information about data privacy and protection):
- Data protection is about ensuring people can trust you to use their data fairly and responsibly.
- If you collect information about individuals for any reason other than your own personal, family or household purposes, you need to comply.
- The UK data protection regime is set out in the DPA 2018, along with the GDPR (which also forms part of UK law). It takes a flexible, risk-based approach which puts the onus on you to think about and justify how and why you use data. (Source: gov.uk website)
What kinds of things might be classed as a GDPR breach?
- Having student information in a document on your laptop without that document being password-protected
- Keeping old unprotected data on CDs or memory sticks in a drawer or shelf where others may be able to access them
- Sending emails with recipient names and addresses visible to all recipients
- Keeping (identifiable) survey data on a shared cloud site without carefully limiting who has access
A thorough guide to GDPR can be found on the UK Information Commissioner's Office website, including a section for educators:
- Guide to the General Data Protection Regulation (GDPR)
- GDPR for schools: The complete guide to GDPR compliance
- Data protection in schools
Your institution should be able to provide more direct guidance through their own policies.
[ ADD LINK TO INSTITUTIONAL GDPR SUPPORT / GUIDANCE ]