Skip to main content
Back to LUC.edu
GDPR @ Loyola
GDPR Request GDPR Privacy Notice

What is GDPR?

The GDPR is a data protection law that applies broadly to the processing of personal information about European Union (EU) residents (Note that, in addition to EU Member States, the GDPR also applies to Iceland, Norway, Liechtenstein, United Kingdom and Switzerland.) Generally speaking, the regulation applies to all personally identifiable data that is collected, used, stored or otherwise processed about individuals in the EU under certain circumstances, by any method including electronic and paper records.

The aims of the regulation include strengthening individuals' rights in the protection of their personal data while at the same time harmonizing rules across EU member states and facilitating the free flow of personal data.

GDPR replaces and expands upon the existing EU Data Protection Directive by adding new substantive requirements and extending the scope of the law to cover certain activities of organizations located outside of the EU.

The GDPR requires institutions to process data according to a set of fundamental principles including that the data is:

  • processed fairly and in a transparent manner;
  • collected for specific and legitimate purposes;
  • limited to what is necessary for the specified purposes;
  • kept accurate and up-to-date;
  • only retained for as long as is necessary;
  • and appropriately secured.

The GDPR also requires institutions to:

  • Ensure that all processing meets one of certain legal bases that are specified under the GDPR
  • Provide data subjects with certain individual rights including the right to receive detailed notices about the collection and the use of their data and to access and amend personal data that is collected about them
  • Engage in data protection impact assessments for activities that pose a high risk of harm to individuals and to incorporate “privacy by design and default” into all of its processing activities
  • Notify the applicable regulatory authority and individuals in the event of certain data breaches and
  • Maintain detailed records of its data processing activities and appoint a Data Protection Officer under certain circumstances.

What areas of Loyola will be impacted?

The GDPR applies to the processing of personal data in the context of organizations established in the EU, which includes Loyola’s EU Global Sites. The GDPR also applies to the processing of data by organizations outside the EU, where those activities are related to offering of goods or services to individuals in the EU, or monitoring of behavior of individuals that takes place in the EU. For example, this may include processing of data by Loyola in the context of recruiting prospective students who are located in the EU or offering services to alumni who are located in the EU.

Any department or school that collects, uses, or otherwise processes personal information about people while they are in the EU may be impacted by the GDPR.