The GDPR applies to personal data. Therefore, the first question to ask is always: for what activity (activities) in your courses do you process personal data? The GDPR only applies to these activities. Watch the GDPR video below before reading the key points for a correct implementation of the GDPR in your courses.
Familiarise yourself with the GDPR, and follow this link for the complete text of this regulation. No time to read all 88 pages? The five key points of the GDPR that every educator needs to know are:
There are various (often simple) measures you can take to maximise student privacy in your courses. An overview of these measures is available on the 'Quick wins' page.
A legal basis, such as consent or a legitimate interest, must exist in order for personal data to be processed. You can view the six possible legal bases in this figure.
Build maximum privacy and data protection safeguards into your course plan from the earliest stages of development. This is referred to as Privacy by Design. And where possible, set all default settings in apps or other software, for example, to the most privacy-friendly option. This is referred to as Privacy by Default.
Comply with the six privacy principles, such as 'data minimisation' and 'transparency’, when processing personal data before, during and after the course. You can view the six privacy principles in this figure.
As long as you are working within the internal systems provided by the organisation, you are fine. The organisation is responsible for these systems and, as an educator, you can rest assured that the organisation has good agreements in place with its suppliers. You will be held accountable if you share the personal data of students or employees outside these systems. So, think carefully about which system you are working in.
In this module, we will discuss in more detail what you, as an educator, must (and should) do under the GDPR. If you would like to learn more about the GDPR, we recommend you visit hulpbijprivacy.nl . This is the website of the Dutch Data Protection Authority and it provides clear general information about the GDPR.
This SURF website also provides a Wiki containing helpful information about, and interpretation of, the regulation, plus a comparison with the Personal Data Protection Act.