Generative AI Practices in European Higher EducationDigital ReportADMIT ReportMapping and Comparative Analysis of Best Practices Across Educational LevelsErasmus+ EthicAI Project · Work Package 2 · Task 2.2 — Prepared by Anadolu University
Practice Matrix · Micro

Data Protection, Privacy and Security

Classroom and learning design · GDPR compliance, data processing agreements, consent, retention and information security.

Back to the matrix
practices
1
Who
—
Where
1
Source report
1

The reading of this intersection

The count in the cell shows density; what the intersection says is carried by the reading below.

Data protection is documented at the institutional level as an instrument, taking the form of a policy, a processing agreement or a licensed platform. What this cell records is the practice that operates at the point at which a person composes a prompt.

Three measures recur and they are of different kinds. The first is a rule concerning content: identifying, sensitive and confidential material does not enter the prompt at all. The second is a choice of venue: a platform the institution has licensed is used in preference to a freely available one, on the ground that the terms attached to them differ. The third is a setting: a temporary chat is opened so that the exchange is not retained.

What makes the pattern worth recording separately from the policies that also require it is the characterisation offered by the report itself, which describes confidentiality as having become a habit rather than remaining a policy. A measure that holds without enforcement has moved from the institution into the practice, and this is the test applied in this report for assignment to the micro level. The same respondents name the instruments through which they learned the measure, so the two readings should be taken together rather than as alternatives.

Who, and where

The actors carrying out the practice and where they are. Where a source does not name the institution, no attribution is made.

Institutions and actors

The source does not name the institution

Countries
  • Multiple countries
Context
  • Higher education

How it was done

Each record stands with its imprint, its short reading and the sentence found in the source. Quotations are not shortened, so that a reader can check the inference.

Keeping personal and confidential data out of the prompt

Respondents in every stakeholder group report withholding personal, sensitive and confidential material from prompts, preferring platforms the institution has licensed to publicly available ones, and using temporary chat modes so that no record is retained. The report characterises the pattern as a habit rather than as compliance with a rule.

Institution
not stated in the source
Country
Multiple countries
Delivery model
not stated in the source
Context
Higher education
Contributed by
not stated in the source
Year
2026
Maturity
Established
Scalability
Established
Transferability
Embedded
Source report
R3
Evidence

Named by the report as one of the most cited themes across all four stakeholder groups, supported by verbatim quotations from administrators, support staff, teachers and students.

No adding of personal data in the prompting that is sensitive for reasons of data protection or that are otherwise confidential.
R3, p. 3.2.3