Description

A key aspect of my role involves ensuring that the use of digital learning platforms complies with data protection legislation, particularly the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018. One common risk area within Moodle is the incorrect enrolment of students with inappropriate permissions—such as being enrolled as a faculty support or editing teacher—which can unintentionally expose sensitive student data or give access to information they are not authorised to view 🔴CP1.

When a data breach occurs, the process begins with notifying the Information Governance Officer and the module leader for the Moodle site. I then go into Moodle to create detailed logs from the affected course, tracking what the individual(s) with heightened permissions have accessed. These logs are downloaded as a spreadsheet, which documents all relevant actions and times. I also revoke the permissions that were incorrectly granted to the student(s) involved in the breach.

These incidents often occur when a student hasn’t fully completed their registration and hasn’t been made live in the student records system. As a result, staff cannot see the student and manually add them to the course—sometimes inadvertently giving them inappropriate access. Once the issue is identified, I work to ensure it is rectified and help prevent similar incidents in the future 🔴CP1.

While I do not deliver formal training specifically on GDPR, I support academic and support staff in understanding how data protection legislation applies to their use of learning platforms like Moodle. This includes raising awareness of what can happen when data breaches occur, highlighting reporting procedures, and advising on the importance of correct enrolment practices. I often use anonymised breach examples from our context to help staff understand the practical implications of improper permissions and access control 🔵CP4.

This awareness-raising is complemented by ongoing collaboration with the Legal and Compliance Team, the IT Department, and the Digital Education team to ensure that our digital learning environments are technically aligned with GDPR principles—particularly in areas such as data security, appropriate retention, and role-based access 🟢CP3. I also ensure my own understanding remains current by completing institutional GDPR mandatory training every two years and engaging with relevant internal guidance. This continuous professional development helps me to confidently support others and to align my practice with the university’s broader data governance framework 🟡CP2.