General Data Protection Regulation (GDPR) Compliance

About the GDPR

The General Data Protection Regulation (GDPR) affects organizations worldwide, including universities. The GDPR:

Replaces the Data Protection Directive 95/46/ec as the primary law regulating how companies and organizations protect the personal data of European Union (EU) residents.
Expands personal privacy rights for EU residents and also affects non-EU citizens located in the EU.
Mandates a baseline set of standards for organizations that handle certain personal and other data of individuals located in the EU to better safeguard the processing and movement of that data.
Applies to institutions with no physical EU presence if they control or process covered information (irrespective of whether the subject individuals are EU citizens).
Calls for fines of up to 4% of annual global turnover, or 20 million euros, whichever is more, for violations of the regulation.

Learn more about the GDPR and its impact on U-M at GDPR Frequently Asked Questions.

The university's GDPR compliance program focuses on these aspects of the GDPR compliance process:

Lawful processing of personal data. The GDPR requires that personal data be processed lawfully, fairly, and in a transparent manner in relation to the data subject. The program engages with units to assess U-M processes that collect or process the personal data of individuals residing in the EU. It also maintain a register of processing activities that have been determined to require compliance with the GDPR.
Data subject rights. Data subjects have a number of rights under the GDPR, including the right to see information about the processing of their personal data, obtain access to own personal data, and request that the data be corrected or erased. In support of these rights, the program provides privacy notices and templates (see GDPR Toolkit) and manages requests from data subjects.
Contract management. The program maintains addenda regarding GDPR compliance to include in contracts with third-party providers that collect and/or process personal data. These addenda have been provided to Procurement Services, which works with units to include them where needed.
Data breach management. In the event of a breach of personal data covered by the GDPR, the program has the responsibility for notifying data protection authorities and data subjects as outlined in the GDPR.
Education and outreach. The program regularly engages in activities and outreach in support of privacy protection across U-M and peer institutions.

Toolkit: General Data Protection Regulation. Includes an assessment to help you figure out if the GDPR applies to your data, along with templates, privacy statements, and more to help you comply if it does.

Direct questions or concerns to [email protected].