Data Flow Mapping for a College

Put simply, data flow mapping for an university is regarding control over a privacy audit file that belongs, in a practical sense, to a student and is held in trust by an university. The university might use it for the purpose it was collected for, disclose it where the law or a valid consent permits, and must protect it everywhere else. Everything in this guide is a way of making that sentence workable at a desk, stage by stage.

Penetration testing finds technical gaps, but it does not test whether a sharing decision was lawful, and both tests are required.

Accessibility tools can collect sensitive data about disability, and their privacy review must be as careful as their accessibility review.

Keeping a personal copy of a record file helps a student track what a college retains, and institutions ought not to obstruct that habit.

Opt-out processes that are hard to find or hard to use will be treated, fairly, as if they did not exist.

Disability documentation is among the most sensitive information an institution retains, and it ought to never travel with broad academic files by default.

Career services hold employment and internship data, and sharing that data with employers needs permission analysis even when the sharing feels helpful.

AI grading tools produce a new record in the form of the grade and the feedback, and that record inherits the protections of the underlying submission.

Library systems retain borrowing and access information that can reveal interests and beliefs, and that information ought not to be treated as low sensitivity by default.

Disclosures to other schools where a student seeks to enrol are permitted, but the student ought to be told that such disclosures occur, via the yearly notification.

An opt-out, once exercised, must be honoured across systems, including directories, publications and data feeds that were built before the opt-out arrived.

Respond to student access requests swiftly and in an usable format, since delay turns a right into a frustration.

Handle transfer and withdrawal files with care, because a student's rights over files previously retained do not end when enrolment ends.

Identify the authorization before the data moves, not following, since retrospective authorization is usually no authorization at all.

Contain removal verification in vendor contracts, with a method and a timetable, since a promised removal without verification shall be doubted.

Assess AI tools with the same gate, plus a specific review of training information use, prompt retention and output handling.

Turn audit findings into a remediation plan with priorities, because a list of findings without a plan is a list of known risks left open.

Plan for remote work explicitly, with controls that travel with the file to staff homes and personal devices.

Review a determination after it is made: was the information used for the stated objective, does the recipient still need it, has retention expired?

Consider a researcher who asks for identifiable student files and is offered a de-identified extract instead, with a written agreement for the study.

Where the full file is genuinely needed in such a case, the sharing is limited, explained to the student where required, and noted in the file.

In that illustration the files are removed from the general system, the affected students are told, and the integration is fixed so it cannot happen again.

Consider an education analytics project that begins with a question regarding storage and ends with a dashboard that nobody can explain to a student.

Consider a counselling service that retains notes in a personal file and is asked whether those notes are education files, and that verifies the exemption before answering.

Writing a policy that employees cannot state without opening the document is a mistake, since the policy shall not be followed under time pressure.

This guide does not track every state rule or agency update in real time, and readers ought to verify current authoritative guidance before acting on a state-particular issue.

Accepting a vendor's consumer confidentiality policy as a substitute for a contract is an error, since consumer policies describe the vendor's own practices, not the college's objectives.

Collecting disability information via assistive technology without reviewing the vendor is a mistake, since usage information may reveal disability.

Obstructing a student's habit of keeping personal copies of their records is an error, because a student who can track their own file spots errors early.