The new European privacy legislation has been in place since 25 May 2016: the General Data Protection Regulation (GDPR). This also has consequences for higher education and research. Institutions have to respond well on time and SURF helps them do this.
SURF services and the GDPR
SURF is working hard to implement the GDPR within its organisation, so that its own services will comply with the regulation as well.
SURF services in accordance with the Legal Standards Framework
SURF provides several services to its members. These services must also comply with the GDPR. That is why the SURF Legal Standards Framework for (Cloud) Services is used for services for which SURF processes personal data on behalf of institutions. Services are organised in a privacy-friendly way as much as possible and solid agreements are made with the institutions and possible (additional) suppliers. The GDPR compliance of other SURF services, such as the network, is also tested. In mediation situations, SURFmarket uses the SURF Legal Standards Framework as a foundation for negotiations with suppliers.
- Research data: if your institution collects data for research, the 'Landelijk Coördinatiepunt Research Data Management' may help
- eduVPN: eduVPN enables employees, researchers and students to easily and securely connect to the Internet and gain access to protected institution services. This service will be formally launched on 1 January 2018, but institutions can currently already try the service for free.