The Privacy Team in the Office of the CIO offers the following privacy-based recommendations that are applicable to most situations. To set up a consultation for a specific use case (e.g., research project, a new/renewed contract with a vendor, new processing activity, etc.), to request a complete privacy review or to ask questions about items on this webpage, contact the Privacy Team at privacy@illinois.edu.   

Definitions

Data Subject	The individual to whom personal information relates.
Data Processing	Any collection, use, storage, transfer, sharing, modification or disposition of data.
Personal Information	Information relating to an individual who is or can be identified by the information, either on its own or combined with other information.

Purpose specification & use limitation 

Data processing should always be restricted to the “need to know” principle – only process the data that is absolutely necessary to get the job done.  We recommend that units:  

Review proposed use cases and determine the specific purpose and the specific data required. Best practice it to restrict data collection/processing to the minimum required to complete the required processing of the use case.
e.g., Collect age ranges or birth year rather than full birth date  
Be consistent with notices provided to data subjects. If the data processing changes, updated notices should be provided.
Consult the Privacy Team to ensure no additional obligations are created from any processing changes.

Transparency & consent

Data subjects should be made aware of what is happening with their data. In order to provide this information to data subjects, units should follow these recommendations:  

Provide clear and accessible notice regarding creation, collection, use, processing, storage, maintenance, dissemination, and disclosure of personally identifiable information (PII). 
Provide the ability to consent to the data collection and data processing by the unit. This consent must be: 
Clearly explained to the data subject  
Definitively granted by the data subject through an action (e.g., checking a box) 
Retained and managed by the unit 
As easy to remove as it was for the data subject to grant 
The Privacy Team can assist units with consent language and placement. 

Data lifecycle

Units should address and plan for how data is processed across the entire data lifecycle- from collection to disposition. 

Collect and store only the required essential personal information to perform functions and processes. 
Identify the retention period applicable to the processing activity and schedule automatic deletion, de-identification, or anonymization where possible and in accordance with university policy. 
Visit the University’s Records Retention Schedules page for more information. 

Third Parties

The university works with many third parties.  It is important they adhere to university policies, practices and procedures. When working with third parties:

Access and disclosure of data subjects’ data should be based on the “need-to-know” principle. Third-party users should receive only the minimum amount of access required to perform their work. 
Establish robust data processing agreements or contracts with vendors and any sub-processors that clearly define the roles, responsibilities, and obligations for handling personal information. 

Generative Artificial Intelligence (GenAI) 

Generative AI should be closely managed by the unit. The Privacy Team hosts comprehensive Generative AI guidance on our website, but included below are some common items that apply to most situations involving Generative AI:  

Make data subjects aware that they are using a Generative AI tool prior to interacting with it.  
Only public data or data assessed and approved for use by the university can be provided to these tools.  
Set appropriate restrictions on Generative AI tools regarding how they learn from or are trained on university data or inputs.  
Prior to the completion of the purchase or contract finalization, the unit should  
Review the Generative AI Solutions Hub website, especially the “Best Practices” and “Resources” pages  
Review the Privacy Considerations for Generative AI webpage  
Review the System Digital Risk Office’s Generative AI webpage  
Complete and submit the Generative AI Risk Awareness and Acknowledgement Form from the System Digital Risk Office 

Security

Proper security of data and the systems that process it are critical for maintaining appropriate privacy for the data. You can receive help from the Governance, Risk, and Compliance (GRC) Team at digitalrisk@illinois.edu to better secure your data across the lifecycle.
Ways to improve data security include:

Implement a Single Sign-On (SSO) mechanism.  
If SSO integration is not feasible, then enforce robust password policies to enhance security, such as requiring regular password updates and utilizing multi-factor authentication. 
Use and maintain industry-standard encryption protocols and secure file transfer methods when transferring files containing personal information.  
Ensure that the third-party servers and vendors meet comparable security standards as required by the university.  
Conduct regular security audits to identify vulnerabilities and mitigate potential risks.  

International data

	General Data Protection Regulation (GDPR)	United Kingdom General Data Protection Regulation (GDPR)	Personal Information Protection Law (PIPL)
Jurisdiction	European Economic Area (EEA)	United Kingdom	Mainland China
Data Subject Rights	All three regulations grant individual data subjects several rights, including the ability to have their data deleted and/or corrected, to obtain a copy of their data, and to restrict its processing.
Locality	Data subjects must be located within the specific jurisdictions when the data is collected by or provided to the university in order for these regulations to apply. Any data that is collected by or provided to the university while the data subject is another location (ex. Illinois) is not covered by these regulations.
Privacy Team’s Compliance Requirements	The Privacy Team will require a Transfer Impact Assessment (TIA) be completed by the vendor or outside organization.  This TIA will aid in the development of a documentation to support the appropriate contract.		Contact the Privacy Team

Laws & regulations to consider