Digital data protection: definitions and comparability

For the analysis, the available evidence should be interpreted with close attention to definitions, population coverage, collection methods and the limits of comparison.

For digital data protection, where an indicator is used as a proxy, the relationship between the proxy and the underlying educational outcome should be stated and tested.

Evidence base for digital data protection

Application to digital data protection depends on evidence from the relevant jurisdiction or institution.

In examining digital data protection: definitions and comparability, for digital data protection, education information should be collected for a defined purpose, protected in proportion to its sensitivity and retained only for an authorised period.

• Test incident and recovery arrangements.
• Assign accountable data owners before it is relied on for a decision with material effect.
• Verify accuracy where information affects learners.
• Minimise collection, identifying the accountable function and affected scope.
• Limit and review access.

Controls for digital data protection

In examining digital data protection: definitions and comparability, definitions, reference periods, population coverage, institutional boundaries and collection practices must be sufficiently aligned for the observed difference to have a stable meaning.

Material concerns include excessive access to learner information, collection without a defined educational or legal purpose, secondary use without adequate authority, and inaccurate data affecting decisions. For decisions concerning digital data protection, review should consider whether an exception is prolonged, recurring or capable of affecting learners outside the cases examined.

For digital data protection, each source should have a stated purpose in supporting or limiting the conclusion. For the analysis, the most relevant material is likely to include lawful authority and consent records where relevant, incident response and notification records, supplier and transfer arrangements, and retention and secure disposal evidence.

• Do the reference periods align?
• Has a classification changed?
• Are exclusions and missing records comparable?
• Is the remaining difference educationally material?
• Are the populations defined on the same basis?

Review of digital data protection

For the analysis, the reviewer should prepare a comparability table before analysing results. For digital data protection, record common elements, material differences, breaks in series and the direction in which each limitation may affect the conclusion; do not rank systems where those limitations remain material.

Interpretation of the comparison should avoid two errors: treating a formal commitment as proof of effect, and treating one adverse case as proof that every part of the system has failed. In reviewing digital data protection, security, privacy and data quality are related but distinct.

For digital data protection, traceability is necessary for accountable decision-making and fair correction. For the analysis, the responsible body should be able to identify the evidence considered, the judgement made, the person or body authorised to make it and the action that followed.

In examining digital data protection: definitions and comparability, neither one indicator nor one control can establish the complete position on the analysis.