Practice Matrix

Data Protection, Privacy and Security

The curated records of Task 2.2. The account view reads them grouped by level and domain; the database view opens the same records for filtering, sorting and downloading.

For reading

Micro

Classroom and learning design1 practices
Multiple countries · 2026

Respondents in every stakeholder group report withholding personal, sensitive and confidential material from prompts, preferring platforms the institution has licensed to publicly available ones, and using temporary chat modes so that no record is retained. The report characterises the pattern as a habit rather than as compliance with a rule.

Maturity: EstablishedTransferability: EmbeddedR3

Meso

Institutional governance2 practices
University of Jyväskylä · Finland · 2023

Information security guidelines issued in December 2023 direct users to work primarily with Microsoft Copilot on a university device while logged in with university credentials. The instrument governs data exposure by prescribing where the interaction takes place rather than by listing prohibited content.

Maturity: EstablishedTransferability: EstablishedD3.1
FernUniversität in Hagen · Germany · 2025

The institution updated its AI guidelines in April 2025 and its recommendations for action in July 2025, both advisory in character, while an overarching AI strategy and guidelines for AI in examinations were under development. Alongside them the university maintains a mandatory internal regulation of learning analytics to ensure data privacy, which is the one binding instrument in the set.

Maturity: EstablishedTransferability: EmbeddedD3.2