Higher Education Business Capability Reference Model (v3.1.0) – Adoption to: Data elements, DPIA, PIA, PII, ePrivacy and GDPR compliance (v.1.0)
Year: 2025
Type: article
Abstract: This document provides a structured privacy and data protection compliance reference mapped across the Higher Education Reference Model (HERM), covering 157 business capability sub-processes spanning three institutional domains: Learning and Teaching, Research, and Enabling Services. For each capability, the mapping identifies the relevant data entities and data elements processed, examples of personally identifiable information (PII) in scope, and practical guidance for conducting Data Protection Impact Assessments (DPIAs), Privacy Impact Assessments (PIAs), and related compliance evaluations under GDPR and the ePrivacy Directive. The original mapping was developed to help higher education institutions identify where and how personal data flows through institutional processes, supporting informed decision-making, appropriate safeguard design, and the demonstration of accountability under the GDPR's data protection-by-design and data protection-by-default principles (Article 25). This version (v2, April 2026) extends the DPIA Considerations column across fifty-three capability entries to incorporate the regulatory developments that have materially changed the compliance landscape since the original publication. New obligations addressed include: the EU AI Act (Regulation (EU) 2024/1689), covering Annex III high-risk AI uses in education and employment including Fundamental Rights Impact Assessment (FRIA) requirements; the NIS2 Directive (2022/2555), covering mandatory incident reporting timelines and supply-chain security obligations; the Cyber Resilience Act (Regulation (EU) 2024/2847), covering SBOM and vulnerability disclosure requirements in procurement; the Data Governance Act (Regulation (EU) 2022/868) and Data Act (Regulation (EU) 2023/2854), covering data intermediation governance and cloud portability obligations; eIDAS 2.0 (Regulation (EU) 2024/1183), covering EU Digital Identity Wallet flows and Electronic Attestation of Attributes issuance; the European Accessibility Act (Directive (EU) 2019/882), covering WCAG 2.2 AA / EN 301 549 obligations across student-facing and staff-facing digital services; and updated EDPB guidance on consent, international data transfers, children's data, and automated decision-making. The document is intended as a practical governance tool for data protection officers, enterprise architects, IT governance professionals, compliance officers, and institutional leaders seeking a capability-level map of personal data processing, privacy risk, and regulatory compliance obligations across the higher education institution. Keywords: GDPR, DPIA, PIA, PII, ePrivacy, higher education, HERM, Enterprise Architecture, data protection, privacy, AI Act, FRIA, NIS2, Data Act, Data Governance Act, eIDAS, accessibility, WCAG, personal data, data governance
Author: Maltusch, Patrik
Institution: Aalto University
Language: English
Subfield: Law
Field: Social Sciences
Domain: Social Sciences
SDG: Quality education
Open Access status: green
OpenAlex ID: W6949670972
FWCI:
Cites:
Cited by:
Related to: