Home / Guides A-Z
All guides A-Z
Every Privacy Ledger guide, listed alphabetically. Each guide opens with a privacy check: the record, the data, the safeguard, and the first check to make.
Ledger 16 - Institutional privacy governance Privacy Governance for Multi-Campus Systems Privacy Governance for Multi-Campus Systems: what it means for a institutional data practice, who may use it, and the check to make before it moves. Ledger 16 - Institutional privacy governance Privacy Governance for Research-Intensive Institutions A plain-language guide to privacy governance for research-intensive institutions: the record, the purpose, the authority and the safeguard. Ledger 16 - Institutional privacy governance Privacy Impact Assessments in Higher Education Privacy Impact Assessments in Higher Education: what it means for a institutional data practice, who may use it, and the check to make before it moves. Ledger 16 - Institutional privacy governance Privacy Metrics a College Can Track Honestly Privacy Metrics a College Can Track Honestly explained for colleges: the rule, the exceptions, and the record an institution should keep. Ledger 20 - Audits, documentation and readiness Privacy Risk Assessments, Done Properly A plain-language guide to privacy risk assessments, done properly: the record, the purpose, the authority and the safeguard. Ledger 16 - Institutional privacy governance Privacy Roles in Small Colleges Without a Dedicated Officer Privacy Roles in Small Colleges Without a Dedicated Officer: what it means for a institutional data practice, who may use it, and the check to make before it moves. Ledger 01 - Student privacy foundations Privacy, Confidentiality and Security: Three Different Jobs A plain-language guide to privacy, confidentiality and security: three different jobs: the record, the purpose, the authority and the safeguard. Ledger 03 - Education records and directory information Publishing a Directory Information Notice That Works A plain-language guide to publishing a directory information notice that works: the record, the purpose, the authority and the safeguard. Ledger 18 - Research data and secondary use Publishing Research Without Identifying Students A plain-language guide to publishing research without identifying students: the record, the purpose, the authority and the safeguard. Ledger 01 - Student privacy foundations Purpose Limitation: The Rule Behind Most Privacy Decisions Purpose Limitation: The Rule Behind Most Privacy Decisions: what it means for an education record, who may use it, and the check to make before it moves. Ledger 15 - Breaches and incident response Ransomware and Student Records A plain-language guide to ransomware and student records: the record, the purpose, the authority and the safeguard. Ledger 18 - Research data and secondary use Re-identification Risk in Small Cohorts A plain-language guide to re-identification risk in small cohorts: the record, the purpose, the authority and the safeguard. Ledger 20 - Audits, documentation and readiness Readiness for a Department of Education Inquiry Readiness for a Department of Education Inquiry explained for colleges: the rule, the exceptions, and the record an institution should keep. Ledger 20 - Audits, documentation and readiness Readiness Reviews Before a New System Launch Readiness Reviews Before a New System Launch: what it means for a privacy audit record, who may use it, and the check to make before it moves. Ledger 12 - Student rights: access and correction Record Inspection Timelines and Practicalities Record Inspection Timelines and Practicalities explained for colleges: the rule, the exceptions, and the record an institution should keep. Ledger 03 - Education records and directory information Records Held by Different Offices: One Student, Many Files A plain-language guide to records held by different offices: one student, many files: the record, the purpose, the authority and the safeguard. Ledger 07 - Vendors and contracts Renegotiating a Legacy Vendor Contract Renegotiating a Legacy Vendor Contract: what it means for a student data held by a vendor, who may use it, and the check to make before it moves. Ledger 15 - Breaches and incident response Repeated Incidents and the Pattern Problem Repeated Incidents and the Pattern Problem explained for colleges: the rule, the exceptions, and the record an institution should keep. Ledger 18 - Research data and secondary use Research Consent Beyond FERPA Exceptions Research Consent Beyond FERPA Exceptions: what it means for a research dataset, who may use it, and the check to make before it moves. Ledger 18 - Research data and secondary use Research Data and Secondary Use: Consent, De-identification and Review A plain-language guide to research data and secondary use: consent, de-identification and review: the record, the purpose, the authority and the safeguard. Ledger 13 - Data retention and minimisation Research Data Retention and Student Privacy Research Data Retention and Student Privacy explained for colleges: the rule, the exceptions, and the record an institution should keep. Ledger 18 - Research data and secondary use Research Data Sharing Agreements Research Data Sharing Agreements: what it means for a research dataset, who may use it, and the check to make before it moves. Ledger 18 - Research data and secondary use Retaining Research Data After a Study Ends A plain-language guide to retaining research data after a study ends: the record, the purpose, the authority and the safeguard. Ledger 13 - Data retention and minimisation Retention for Transcripts and Permanent Records Retention for Transcripts and Permanent Records explained for colleges: the rule, the exceptions, and the record an institution should keep. Ledger 13 - Data retention and minimisation Retention Schedules for Student Records Retention Schedules for Student Records explained for colleges: the rule, the exceptions, and the record an institution should keep. Ledger 13 - Data retention and minimisation Retention When a College Closes or Merges Retention When a College Closes or Merges: what it means for a retained student record, who may use it, and the check to make before it moves. Ledger 10 - AI tools and student privacy Saying No to an AI Tool: The Privacy Case Saying No to an AI Tool: The Privacy Case explained for colleges: the rule, the exceptions, and the record an institution should keep. Ledger 02 - FERPA in full School Officials With a Legitimate Educational Interest School Officials With a Legitimate Educational Interest: what it means for an education record, who may use it, and the check to make before it moves. Ledger 18 - Research data and secondary use Secondary Use of Education Records for Research Secondary Use of Education Records for Research explained for colleges: the rule, the exceptions, and the record an institution should keep. Ledger 13 - Data retention and minimisation Secure Deletion Methods That Hold Up A plain-language guide to secure deletion methods that hold up: the record, the purpose, the authority and the safeguard. Ledger 14 - Security controls for student data Security Assessments and Penetration Testing Security Assessments and Penetration Testing: what it means for a student record system, who may use it, and the check to make before it moves. Ledger 14 - Security controls for student data Security Baselines for New Systems Security Baselines for New Systems explained for colleges: the rule, the exceptions, and the record an institution should keep. Ledger 14 - Security controls for student data Security Controls for Student Data: Making a Privacy Promise Real Security Controls for Student Data: Making a Privacy Promise Real: what it means for a student record system, who may use it, and the check to make before it moves. Ledger 14 - Security controls for student data Security for Remote and Hybrid Staff Security for Remote and Hybrid Staff: what it means for a student record system, who may use it, and the check to make before it moves. Ledger 14 - Security controls for student data Security Training for Staff Handling Records A plain-language guide to security training for staff handling records: the record, the purpose, the authority and the safeguard. Ledger 08 - Cloud systems and student portals Shadow Cloud Tools Staff Adopt Without Approval Shadow Cloud Tools Staff Adopt Without Approval explained for colleges: the rule, the exceptions, and the record an institution should keep. Ledger 08 - Cloud systems and student portals Shared Drives and Accidental Disclosure Shared Drives and Accidental Disclosure explained for colleges: the rule, the exceptions, and the record an institution should keep. Ledger 08 - Cloud systems and student portals Single Sign-On and Student Identity Data Single Sign-On and Student Identity Data explained for colleges: the rule, the exceptions, and the record an institution should keep. Ledger 03 - Education records and directory information Sole Possession Notes and the Personal Note Exception Sole Possession Notes and the Personal Note Exception explained for colleges: the rule, the exceptions, and the record an institution should keep. Ledger 17 - State student privacy laws State Attorney General Enforcement for Student Data A plain-language guide to state attorney general enforcement for student data: the record, the purpose, the authority and the safeguard. Ledger 17 - State student privacy laws State Biometric Laws Affecting Colleges State Biometric Laws Affecting Colleges: what it means for a student record under state law, who may use it, and the check to make before it moves.