What does the GDPR mean for universities?

The General Data Protection Regulation (GDPR) is the European Union's law on personal data. It sets principles for collecting and using data about people, gives those people enforceable rights and expects organizations to show how they comply. The United Kingdom applies a closely related version, the UK GDPR, alongside its own rules on electronic marketing.

Each use of a prospective student's data needs a lawful basis. Answering a question the student asked may rest on different grounds from adding them to a marketing sequence, and electronic marketing often needs consent under separate e-privacy rules. Collect what recruitment needs, set retention periods for applicants who don't enroll, and take extra care with special category data, such as health information shared to request accommodations.

Students can ask to access, correct or erase their data, and they can object to direct marketing at any time. Recruitment agents, fair organizers and software vendors that process data for the university need written terms, and data moving out of the EU or UK needs a recognized transfer mechanism. Graduate and international offices that buy lists or run events abroad should check each source's basis before importing it.

Consider a hypothetical university in Canada that runs recruitment fairs in Germany and Spain. The names collected at its booth, the follow-up emails and the records it shares with a local recruitment agent all involve personal data of people in the EU. The university should know its lawful basis for each of those steps, tell students how their data will be used, and decide how long it keeps the records of students who never apply.

Does the GDPR apply to a university outside Europe? It can, when the university offers places to people in the EU or monitors their behavior online. Treat this entry as general information; your data protection officer or counsel decides how the law applies to your recruitment.