Generative AI Practices in European Higher EducationDigital ReportADMIT ReportMapping and Comparative Analysis of Best Practices Across Educational LevelsErasmus+ EthicAI Project · Work Package 2 · Task 2.2 — Prepared by Anadolu University
Practice Matrix · Meso

Data Protection, Privacy and Security

Institutional governance · GDPR compliance, data processing agreements, consent, retention and information security.

Back to the matrix
practices
2
Who
2
Where
2
Source report
2

The reading of this intersection

The count in the cell shows density; what the intersection says is carried by the reading below.

Data protection is regulated at this level by controlling the setting rather than by listing forbidden content. One institution directs staff to work primarily with a named assistant on a university device, logged in with university credentials, which is a checkable instruction in a way that an appeal not to share sensitive data is not. Another maintains an internal regulation of learning analytics that it describes as mandatory, standing alongside advisory AI guidelines whose second version was issued in April 2025 and recommendations for action whose third version followed in July 2025.

The contrast within that second record constitutes the finding: within a single institution, the binding instrument governs the data infrastructure while the advisory instrument governs the use of the tools.

Who, and where

The actors carrying out the practice and where they are. Where a source does not name the institution, no attribution is made.

Institutions and actors
  • University of Jyväskylä
  • FernUniversität in Hagen
Countries
  • Finland
  • Germany
Context
  • Higher education

How it was done

Each record stands with its imprint, its short reading and the sentence found in the source. Quotations are not shortened, so that a reader can check the inference.

Information security guidelines steering staff to an institutionally controlled tool

Information security guidelines issued in December 2023 direct users to work primarily with Microsoft Copilot on a university device while logged in with university credentials. The instrument governs data exposure by prescribing where the interaction takes place rather than by listing prohibited content.

Institution
University of Jyväskylä
Country
Finland
Delivery model
not stated in the source
Context
Higher education
Contributed by
not stated in the source
Year
2023
Maturity
Established
Scalability
Embedded
Transferability
Established
Source report
D3.1
Evidence

The guideline prescribes the device, the account and the tool, which is a stronger and more checkable control than a general instruction not to share sensitive data.

Primarily use Microsoft's Copilot's AI-based conversation on a university device and while logged in to the Edge browser with university credentials!
D3.1, p. 33

Revised AI guidelines with a mandatory learning analytics regulation

The institution updated its AI guidelines in April 2025 and its recommendations for action in July 2025, both advisory in character, while an overarching AI strategy and guidelines for AI in examinations were under development. Alongside them the university maintains a mandatory internal regulation of learning analytics to ensure data privacy, which is the one binding instrument in the set.

Institution
FernUniversität in Hagen
Country
Germany
Delivery model
Fully online
Context
Higher education
Contributed by
not stated in the source
Year
2025
Maturity
Established
Scalability
Established
Transferability
Embedded
Source report
D3.2
Evidence

The institution distinguishes the advisory documents from the mandatory regulation in the same entry, which is what allows the contrast to be recorded rather than inferred.

There is also a mandatory internal Regulation of Learning Analytics to ensure data privacy.
D3.2, p. 41