Elicitation of Personal Data Categories for Implementing Data Protection: An Exploratory Study in an Educational Institution

Protecting the privacy of natural persons has become very important in today's data economy. Countries around the world are in the process of legislating data protection regulations to prevent breaches of personal data. However, the implementation of data protection is very much domain and context-specific. The data categories that are to be protected in the domain of implementation need to be discovered. We propose a human-centric approach for eliciting such data categories that cause privacy concerns to stakeholders in an educational institution. A study was conducted to understand the privacy concerns of the stakeholders, related to different data categories to be protected. A combination of surveys and in-depth interviews of the different stakeholders were used to gain insights into the privacy and data protection requirements that need to be incorporated into the associated information system design.