Complying with the EU General Data Protection Regulation can be an onerous undertaking, but for England's University of Derby it provided a real opportunity: create a more cohesive policy on privacy for current and future students who are increasingly aware of the need to safeguard their personal data and to foster a culture of security among staff to enforce cybersecurity. Ahead of the this month's IAPP Europe Data Protection Congress, the University of Derby has been recognized as an "honorable mention" for the 2017 HPE-IAPP Privacy Innovations Award for its implementation of a new data classification scheme, via its data governance board. 

The HPE-IAPP Privacy Innovation Awards recognize unique programs and services in global privacy and data protection in the private and public sectors. The award recognizes organizations that integrate privacy in such a way that elevates its value as both a competitive differentiator and a centerpiece of customer and citizen trust.

Aiming to safeguard personal data, the university assembled the information governance board and charged it with developing clear policies and procedures to protect personal data, as well as to adopt technical and organizational measures to achieve them. The board charged James Eaglesfield, CIPM, with implementing the project. Eaglesfield, who is responsible for information security, data protection, freedom of information and IT project management, said he left that particular board meeting with a "bit of jitters" as he understood the enormity of the project.

"While it was one thing for the board to agree upon the conditions, it was quite another to implement the plan," he said.

Working with the central IT department, Derby first began the undertaking of enhancing its data privacy and cyber security stance by implementing a new information-management scheme. The change not only benefited Derby in terms of data security, improved governance, risk mitigation, efficiency and effectiveness of data management practices, but put it in line with the GDPR's mandates as well. It also offered transformation by bringing in new technologies and ways of thinking across the university and helped to create a culture shift by engaging staff and drawing attention to data protection, Eaglesfield said. 

The board's order was to embed Derby's new data-classification system, which employed cloud technology within the existing scheme, throughout the university without affecting key business processes or impacting service delivery. The original aim of the project was to have something set in place within five months to cover 10 percent of the university. Instead, Eaglesfield said, the plan was fully operational and embedded — reaching 350 people —  within two-and-a-half months. In five months, the project went from no users to being fully embedded within the university. 

Going forward, Derby hopes the implemented technologies demonstrate to potential partners that it can be trusted with their data via consistent, integrated, best practice data-handling processes and procedures. 

Eaglesfield also said that Derby has changed how it does privacy, going so far as to develop the first privacy policy directed at current, incoming and prospective students. 

photo credit: Leshaines123 Buxton College University of Derby #Dailyshoot #Peak District via photopin (license)