The European Union (EU) General Data Protection Regulation

The European Union (EU) General Data Protection Regulation (GDPR) is a new data privacy regulation that went into effect on May 25, 2018. If users enter data into ASU’s systems while residing in the EU, they are covered by this regulation, which is designed to provide rights to individuals within the EU regarding data privacy and reshape how organizations approach data privacy.

ASU has developed a risk-based GDPR compliance program to assist in analyzing and complying with GDPR requirements. The Provost Office, the Information Security Office and the Office of General Counsel have convened a working group with representatives from across the university. This team has updated enterprise requirements such as the ASU Privacy Statement, provided a Supplemental ASU Privacy Provisions for Persons in the European Union and added required GDPR Contractual Requirements to our Terms and Conditions. Please use these documents.

Each unit is responsible for ensuring its internal processes are compliant.

It could take some time to develop a more precise understanding of how GDPR will be further defined, interpreted, and enforced. ASU will pay close attention to the evolution of the law's compliance requirements over the coming years and will respond to and adjust compliance efforts as needed.