Personal Data Protection in Higher Education Institutions: Existing Regulation and Challenges

Abstract

This article investigates the legal and practical framework of personal data protection in Georgian higher education institutions and evaluates its alignment with European standards, particularly the GDPR. Theoretically, the study establishes the conceptual foundations of data protection, including fundamental rights, the connection to human dignity, and core principles. Empirically, it analyzes universities’ internal documentation concerning personal data processing and examines current practices, including the standards for obtaining data subject consent, data retention periods, security measures, and data transfers. From a comparative-legal perspective, the study explores examples from Germany, Poland, and Estonia, highlighting similarities and differences with Georgian regulations.

The findings indicate that, despite the harmonization of Georgia’s “Law on Personal Data Protection” (14 June 2023) with European data protection standards, systemic challenges persist within universities. These include formalized consent management, institutional weaknesses of the Data Protection Officer (DPO), incomplete data security protocols, insufficient regulation of access to student information, low awareness among staff and students, and issues related to academic freedom.

Based on these findings, the study recommends: the comprehensive elaboration of internal documentation related to personal data processing and ensuring transparency for data subjects; raising awareness among staff and students through regular training; strengthening the independence and resources of the DPO; harmonizing internal policies with GDPR principles; and implementing recognized technical standards (ISO 27001/27701). Collectively, these measures are expected to enhance a culture of accountability and trust within the university environment and facilitate Georgia’s integration into the European higher education ecosystem.