Common Scenarios that Require GDPR Compliance

Common Scenarios that require GDPR compliance

These are common scenarios that faculty, staff, and students may encounter where GDPR compliance is required.


A German student uses the Graduate Division website to apply for admission to the Sociology Department and shares confidential information about their religious beliefs.

Arts and Entertainment

The parent of an undergraduate student from Texas buys Alvin Ailey Dance Theatre tickets on the Cal Performances website while on vacation in Croatia.


Rugby team coaches recruit athletes in Spain.

Career Services

Haas Business School shares information about current Executive MBA students with potential employers and recruitment firms.

Conference (Domestic)

The Simon Institute organizes a conference on Privacy in Berkeley and several faculty members from a university in Bulgaria register to attend.


A Berkeley Alumnus who lives in Italy donates $100 to the Institute for the Study of Societal Issues and the Student Mentoring and Research Teams program.

Faculty (sabbatical)

A faculty member spends a sabbatical year in France studying the wine industry and communicates regularly with their students back in Berkeley.

Human Resources

A newly hired Associate Professor from New York, currently completing a visiting appointment at the Sorbonne, submits their W-4 remotely.


A Department, faculty member, graduate student, or staff member runs a listserv that has subscribers in the EU.

Medical (Optometry)

UC Berkeley Optometry receives an order for new prescription goggles from a member of the Basketball team who is in the EU competing in the Basketball World Cup.

Medical (Tang Center)

A newly admitted student to the JSP program submits immunization records to University Health Services through the eTang Patient portal from their home in Malta.


The purchase of software or other tools which do not include privacy by design.

Research (faculty)

A faculty member studying diffusion and contagion on Facebook collects information on subjects who reside in the EU.

Research (graduate student)

A PhD student in the African American and African Diaspora studies department conducting IRB approved research on black piracy, working alongside the UN Office on Drugs and Crime, interviews several dozen people in the custody of the European Union Naval Force who hijacked ships just outside of the International Recommended Transit Corridor.

Research (undergraduate student)

A student in the McNair program performs IRB approved research which includes an online survey of Cape Verdean immigrants in Massachusetts.  Their survey is forwarded more widely than they intended and includes Cape Verdeans in Portugal and Spain.

Study Abroad

Berkeley students from all over the world study abroad in the EU through the Berkeley Study Abroad Office's "Made in Italy: Language, Culture, Food and Business, Florence" program.

 Although these interactions may appear routine, after May 25, 2018 they all require adherence to GDPR.