Higher Education Business Capability Reference Model (v3.1.0) – Adoption to: Data elements, DPIA, PIA, PII, ePrivacy and GDPR compliance (v.1.0)

You will find a simple approach to Teaching & Learning, Research and enabling capabilities to include a “Privacy Considerations” column. These additional columns suggest the key elements that should be analysed when conducting a Data Protection Impact Assessment (DPIA) or similar assessments (PIA, DPA). These suggestions are general guidelines that can be adapted based on the institution’s specific context, data flows, and regulatory (and local) requirements. This listing should be useful to help identify where and how personal data is processed across various institutional capabilities. By mapping capabilities to the personal data they handle and adding DPIA considerations, institutions can more easily comply with privacy regulations such as GDPR and ePrivacy. It supports informed decision-making, ensures appropriate safeguards and transparency measures, and helps maintain trust by respecting data subjects’ rights and privacy. This list far from comprehensive and should not replace a local due diligence when applying compliance in your own organization.