GDPR and Distance Teaching and Learning

Due to the pandemic lockdown that started in March 2020 educational organizations had to implement online telework and distance teaching frameworks in a few days. For most organizations the priority was to get the implementation up and running, and many had to postpone verifying their compliance to security and privacy regulations. In 2021 the security of these online frameworks is better, but their privacy which depends on the behavior of users must be improved. The General Data Protection Regulation (GDPR) came into force in May 2018, resulting in European citizens getting more rights and increased transparency on how their data can be collected and processed. Organizations must inform their users what they will do with their data before it is collected/processed and how individuals can keep their privacy and security. In this work we analyze what higher education institutions in Portugal must do to comply with GDPR when using online frameworks for Distance Teaching and Learning. We also analyze the results of a questionnaire distributed to higher education students showing how informed they are about maintaining their security and privacy when using distance teaching and learning frameworks.