Data Protection and Privacy Policy

DOCUMENT INFORMATION

1. AIM / PURPOSE

The purpose of this Policy is to establish a comprehensive framework for the protection, collection, processing, storage, transmission, retention, sharing, and disposal of personal, academic, administrative, and institutional data within Alhamd Islamic University, particularly in support of Open and Distance Learning (ODL), Learning Management Systems (LMS), Student Information Systems (SIS), digital learning platforms, and other technology-enabled services.

This Policy aims to:

1. Protect the privacy and confidentiality of students, faculty, staff, and stakeholders.
2. Ensure responsible and lawful handling of information assets.
3. Maintain trust in digital learning environments.
4. Safeguard institutional data from unauthorized access, disclosure, alteration, loss, or misuse.
5. Support compliance with HEC requirements, accreditation standards, cybersecurity principles, and recognized international best practices.
6. Establish accountability for all individuals handling University information.
7. Promote secure and ethical use of digital technologies within the University.

2. SCOPE

This Policy applies to:

• All students.
• Faculty members.
• Administrative staff.
• Contractual employees.
• Visiting faculty.
• Consultants and third-party service providers.
• ODL Directorate personnel.
• IT Directorate personnel.
• External auditors and authorized reviewers.

The Policy applies to all information processed through:

• Learning Management Systems (LMS).
• Student Information Systems (SIS).
• Online Examination Systems.
• University Websites and Portals.
• Cloud-Based Services.
• Institutional Email Systems.
• Mobile Applications.
• Digital Libraries.
• Research Data Repositories.
• Administrative Information Systems.

The Policy covers:

• Personal Data.
• Academic Records.
• Assessment Records.
• Research Data.
• Employee Information.
• Financial Information.
• System Logs and Learning Analytics.
• Digital Communications.

3. DEFINITIONS

Personal Data

Any information that identifies or can reasonably identify an individual directly or indirectly.

Examples include:

• Name
• CNIC/Passport Number
• Registration Number
• Contact Information
• Email Address
• Photographs
• Recorded Sessions
• Biometric Information
• IP Addresses

Sensitive Personal Data

Information requiring enhanced protection including:

• Identity documents
• Financial information
• Biometric records
• Health-related information
• Examination credentials
• Authentication data

Data Subject

An individual whose personal information is collected, processed, stored, or used by the University.

Data Processing

Any activity involving collection, recording, storage, retrieval, use, modification, transmission, sharing, archiving, or deletion of data.

Information Asset

Any information resource owned, maintained, or managed by the University.

Data Breach

Any unauthorized access, disclosure, alteration, destruction, loss, theft, or compromise of information.

LMS

Learning Management System used for online teaching, learning, assessment, communication, and academic administration.

ODL

Open and Distance Learning delivered through technology-enabled learning environments.

4. ROLES AND RESPONSIBILITIES

4.1 Rector

The Rector shall:

• Provide institutional oversight.
• Ensure strategic commitment to data protection.
• Approve major governance frameworks.

4.2 Academic Council

The Academic Council shall:

• Oversee academic data governance.
• Ensure compliance with academic regulations.
• Review policy implementation effectiveness.

4.3 Directorate of ODL

The Directorate of ODL shall:

• Ensure privacy compliance within online learning environments.
• Monitor LMS data practices.
• Coordinate privacy awareness and training.
• Maintain secure academic records.

4.4 Directorate of Information Technology

The IT Directorate shall:

• Implement technical safeguards.
• Manage cybersecurity controls.
• Monitor system security.
• Conduct backups and disaster recovery.
• Investigate security incidents.

4.5 Quality Enhancement Cell (QEC)

The QEC shall:

• Evaluate compliance during quality audits.
• Monitor data governance effectiveness.
• Recommend improvements.

4.6 Heads of Departments

HoDs shall:

• Ensure departmental compliance.
• Monitor faculty adherence.
• Protect academic records.

4.7 Faculty Members

Faculty members shall:

• Protect student information.
• Use institutional platforms responsibly.
• Maintain confidentiality of academic records.
• Avoid unauthorized sharing of student data.

4.8 Students

Students shall:

• Protect account credentials.
• Respect privacy of peers and faculty.
• Use University systems responsibly.
• Report suspected security incidents.

5. COMPLIANCE REQUIREMENTS

5.1 Data Collection Principles

The University shall collect only information that is:

• Necessary
• Relevant
• Accurate
• Legitimate
• Purpose-specific

No excessive or unnecessary personal information shall be collected.

5.2 Data Usage Principles

Data shall be used only for:

• Academic administration
• Student support services
• Learning activities
• Assessment and evaluation
• Regulatory reporting
• Quality assurance
• Institutional research

5.3 Data Security Requirements

Administrative Controls

• Access management procedures
• User authorization controls
• Staff awareness programs
• Confidentiality agreements

Technical Controls

• Password protection
• Multi-factor authentication where applicable
• Encryption technologies
• Antivirus and endpoint protection
• Network security controls
• Secure backups

Physical Controls

• Restricted server access
• Secure storage facilities
• Controlled equipment access

5.4 LMS and ODL Privacy Requirements

All LMS platforms shall:

• Require authenticated user access.
• Maintain audit trails.
• Protect student records.
• Secure assessment data.
• Restrict unauthorized downloading of sensitive information.
• Ensure confidentiality of grades and feedback.

Recorded lectures containing student participation shall be managed responsibly and accessed only for legitimate educational purposes.

5.5 Data Retention Requirements

5.6 Data Sharing Requirements

Personal information shall only be shared:

• When legally required.
• For accreditation purposes.
• For regulatory reporting.
• With authorized institutional stakeholders.
• With explicit approval where necessary.

Third-party service providers shall be subject to confidentiality and security obligations.

5.7 Data Breach Management

All actual or suspected data breaches shall be:

1. Reported immediately.
2. Investigated promptly.
3. Documented appropriately.
4. Remediated effectively.
5. Reviewed for corrective actions.

6. EXCEPTIONS

Exceptions may be granted only under:

• Court orders.
• Regulatory directives.
• National security requirements.
• Emergency situations.
• Approved research activities with ethical clearance.

All exceptions shall be documented and approved by competent authority.

7. VIOLATIONS AND CONSEQUENCES

The following shall constitute violations:

Unauthorized Access

• Accessing information without authorization.
• Sharing passwords or credentials.

Unauthorized Disclosure

• Sharing confidential information.
• Publishing private records.

Data Manipulation

• Altering academic records.
• Modifying grades without authorization.

Misuse of Information Systems

• Downloading restricted information.
• Unauthorized copying of institutional data.

Cybersecurity Violations

• Malware introduction.
• Hacking attempts.
• Circumvention of security controls.

Consequences

Depending upon severity:

• Verbal warning.
• Written warning.
• Suspension of access privileges.
• Academic penalties.
• Disciplinary proceedings.
• Financial liability where applicable.
• Employment termination.
• Expulsion from the University.
• Legal action under applicable laws.

8. MONITORING AND REVIEW

Monitoring activities may include:

• Security audits.
• LMS compliance reviews.
• Privacy assessments.
• Access log reviews.
• Risk assessments.
• Vulnerability assessments.
• Internal audits.
• External quality reviews.

Key Performance Indicators (KPIs)

• Number of privacy incidents.
• Number of data breaches.
• LMS security compliance rate.
• User awareness training completion rate.
• System uptime.
• Audit compliance score.

This Policy shall be reviewed every two years or whenever required by changes in:

• HEC regulations.
• Accreditation requirements.
• Cybersecurity threats.
• Institutional priorities.

9. REFERENCES

This Policy shall be read in conjunction with:

1. HEC Open and Distance Learning Policy.
2. HEC Quality Assurance Framework.
3. HEC Institutional Performance Evaluation Criteria.
4. University Statutes, Regulations, and Rules.
5. Information Security Policies of the University.
6. LMS Usage Policy.
7. Cybersecurity Policy.
8. Research Ethics Policy.
9. Applicable national laws and regulations relating to information security and privacy.
10. International best practices including ISO 27001 Information Security Management Principles and higher education data governance standards.

10. APPENDICES / ACTION STATUS

A: Data Classification Framework

B: Acceptable Use Requirements

Users shall:

• Use institutional systems responsibly.
• Maintain password confidentiality.
• Avoid unauthorized access.
• Report security incidents promptly.

C: Data Breach Reporting Procedure

1. Identify Incident
2. Report to IT Directorate
3. Incident Assessment
4. Containment
5. Investigation
6. Recovery
7. Documentation
8. Corrective Action

D: Minimum Security Controls for LMS and ODL Platforms

• Secure Authentication
• Role-Based Access Control
• Data Encryption
• Audit Logging
• Backup and Recovery
• Incident Monitoring
• Regular Security Updates

E: Privacy Notice Statement

Alhamd Islamic University is committed to protecting the privacy, confidentiality, integrity, and availability of personal and institutional information entrusted to it and shall process such information solely for legitimate educational, administrative, regulatory, and quality assurance purposes in accordance with applicable laws, HEC requirements, and University regulations.