Exploring the Implementation of Data Protection in A Private Institution: Basis for A Strategic Action Plan
DOI:
https://doi.org/10.65339/ijsair.V2.I2.589Keywords:
Data Protection Strategic Action Plan, Data Protection Practices, Educational Data Privacy, Information Security, Protection Motivation Theory, Senior High School FacultyAbstract
This study examined the implementation of data protection among Senior High School faculty at NU Fairview and developed a Data Protection Strategic Action Plan to strengthen institutional compliance and information security. Anchored on Protection Motivation Theory (PMT), the study explored faculty perceptions of data threats, efficacy in safeguarding student information, existing data protection practices, and barriers affecting compliance. A convergent parallel mixed-methods design was employed, integrating quantitative and qualitative data collected from 45 full-time faculty members through a researcher-made Protection Motivation Appraisal Survey and a semi-structured interview guide. Forty-four faculty members completed the survey, while eight representatives participated in a Focus Group Discussion. Quantitative data were analyzed using descriptive statistics, while qualitative data underwent deductive thematic analysis, followed by data integration through a Joint Display Method. The findings revealed that faculty members demonstrated high awareness of data protection risks and consistently practiced physical and digital safeguards, including data minimization, access control, secure communication, and responsible document handling. However, compliance efforts were constrained by infrastructure limitations, inadequate cloud and physical storage facilities, operational burdens, knowledge gaps, and insufficient policy dissemination. Faculty reported confidence in routine data protection practices but showed lower confidence in technical competencies and formal reporting procedures. The convergence of quantitative and qualitative findings further revealed that many compliance behaviors relied on self-developed workarounds rather than structured institutional support. The study concluded that while faculty possess strong protection motivation, institutional barriers hinder consistent and sustainable compliance. Consequently, the study recommends implementing a Data Protection Strategic Action Plan focused on infrastructure enhancement, policy operationalization, targeted training, and reduced operational friction. This study supports SDG 4 (Quality Education), SDG 9 (Industry, Innovation and Infrastructure), and SDG 16 (Peace, Justice and Strong Institutions) by promoting secure educational environments, responsible digital governance, and strengthened institutional accountability. Its sustainability contribution lies in enhancing educational, technological, and institutional sustainability through improved data governance, privacy protection, and information security practices.
References
Agup, A. P. (2024). Data Privacy Act: Awareness, compliance, and challenges of nurses of government hospitals in Northern Philippines. Philippine Social Science Journal, 7(2), 112–122.
Alejandrino, L. M. (2024). An analysis of state universities and colleges students’ level of awareness on digital footprints and data privacy in Davao Region, Philippines. International Journal of Multidisciplinary: Applied Business and Education Research, 5(4), 1258–1269.
Almekhled, A., & Petrie, H. (2024). University academics’ awareness and knowledge of online privacy and security policies: A mixed-methods study. Education and Information Technologies, 29(2), 1187–1204.
Anderson, M., & Choong, Y.-Y. (2023, October 10). Using strong passwords and a password manager [Blog post]. NIST Computer Security Resource Center.
Asia-Pacific Economic Cooperation. (2015). APEC privacy framework. https://www.apec.org/publications/2017/08/apec-privacy-framework-(2015
Asian Journal of Management Studies. (2021). Assessment of the implementation of the Data Privacy Act of 2012 (RA 10173) in higher educational institutions. https://asianjournals.org/online/index.php/ajms/article/download/459/275/1283
Ayop, J. R., Larecion, R. C., Respulo, A. A. P., Villasurda, R. A. S., Arendain, K. M. A., & Cantil, J. B. J. (2025). Relationship of social media usage and data privacy awareness among college students in the municipality of Bansalan. Asian Journal of Education and Social Studies, 51(7), 617–627.
Baluis, M. J. (2023). Safeguarding privacy, ensuring ethics: Exploring implications of data-driven workforce planning in state universities and colleges. Philippine Journal of Educational Management, 30(1), 45–60.
Canada, J. R., Lara, A., Jr., Josol, C., & Albon, E. (2025). Online privacy concerns, impacts and coping strategies among college students in Digos City, Philippines: A descriptive phenomenological study. Asian Journal of Education and Social Studies, 51(10), 605–619.
Correia de Barros, Y., & Vilela, J. (2025). Data privacy in educational contexts: Analyzing perceptions, practices and challenges in personal data protection. Contemporary Educational Technology, 15(1), ep399.
Dalelio, C. M. (2024). Respecting students’ privacy boundaries and media use preferences while teaching with online digital tools. Journal of Public Relations Education, 10(3), 158–177.
de Barros, P. M., & Vilela, R. S. (2025). Data protection practices and challenges in Brazilian educational institutions under the LGPD: A case-based analysis. Journal of Information Privacy and Security, 21(1), 33–52.
EDUCAUSE. (2022). Student data privacy and security: A call for transparent practices. EDUCAUSE.
General Data Protection Regulation. (2018). What is GDPR, the EU’s new data protection law? https://gdpr.eu/what-is-gdpr/
Gundaboina, A. K. (2025). Securing BYOD (Bring Your Own Device) in education: Endpoint management for school networks. Journal of Engineering and Applied Sciences Technology, 7(4), 1–6.
Hahn, A. (2024). Communication Privacy Management Theory. EBSCO Research Starters.
Halawi, L. A., & Makwana, A. (2023). GDPR compliance in U.S. higher education institutions: A comparative review and implications for data governance. Journal of Higher Education Policy and Management, 45(4), 437–456.
Halawi, L., & Makwana, A. (2023). The GDPR and UK GDPR and its impact on US academic institutions. Issues in Information Systems, 24(2), 232–241.
International Organization for Standardization. (2019). ISO/IEC 27701:2019 Security techniques—Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management—Requirements and guidelines. https://www.iso.org/standard/71670.html
Kapoh, H., Aprilyana, P., Sumampow, Y. J. R., Mailake, M. P., Manimpurung, F. H., & Pakaya, H. Q. (2024). Data security and data protection in cloud privacy systems. Jurnal Syntax Admiration, 5(11), 4801–4809.
King, E. M. N., & Pajo, P. (2025). AI in Philippine education: Opportunities, challenges, and ethical considerations for personalized learning [Preprint]. ResearchGate.
Lu, H., Wei, A., & Li, X. (2025). Understanding the privacy disclosure behavior and privacy concerns on short-form video platforms: An empirical investigation. Frontiers in Psychology, 16, 1535533.
Mailok, R., Nordin, N., & Sulaiman, A. (2023). University students’ awareness and practices of personal data protection in Malaysia. International Journal of Advanced Computer Science and Applications, 14(5), 456–463.
Martirez, K. C. (2023). Compliance on Data Privacy Act of private higher educational institutions in the province of Albay: Basis for information governance model. International Journal of Education, Business and Economics Research, 3(3), 26–36.
Miano, L. C. (2025). Awareness on data privacy vis-à-vis data management practices at a state university in Quezon province: Input towards data-driven policy and manual for good governance. Edelweiss Applied Science and Technology, 9(1), 302–315.
Mollakuqe, E., & Dimitrova, V. (2024). Comparative analysis of identity management, access control, and authorization practices in public and private universities. Open Research Europe, 4, Article 23.
National Privacy Commission. (2020). Advisory No. 2020-01: Guidelines on the use of videoconferencing tools and similar applications in the education sector. https://privacy.gov.ph/wp-content/uploads/2023/05/DP-Council-Education-Sector-Advisory-No.-2020-1.pdf
National Privacy Commission. (2022, March 25). Privacy Policy Office Advisory Opinion No. 2022-014: Recording and uploading of online classes [PDF]. National Privacy Commission.
National Privacy Commission. (n.d.). Breach reporting. National Privacy Commission.
National University. (2023). Faculty manual 2023.
National University. (2024). Privacy policy. https://www.national-u.edu.ph/privacy/
National University. (2025, May 19). NU campuses unite for basic research ethics training – Batch 2. https://www.national-u.edu.ph/nu-laguna/nu-campuses-unite-for-basic-research-ethics-training-batch-2/
Nottingham, E., Stockman, C., & Burke, M. (2022). Education in a datafied world: Balancing children’s rights and schools’ responsibilities in the age of COVID-19. Computer Law & Security Review, 45, 105664.
Parents’ perceptions of privacy policies and practices for school-issued digital devices: Implications for school practices. (2022). PLOS ONE, 17(9), e0274667.
Ramos, G. L. (2022). Perceptions of students, faculty, and administrative staff on the Data Privacy Act: An exploratory study. Asia Pacific Journal of Multidisciplinary Research, 10(3), 34–46. https://doi.org/10.5281/zenodo.7654981
Republic Act No. 10173. (2012). The Data Privacy Act of 2012. https://privacy.gov.ph/data-privacy-act/
Respicio, H. (2025, April 30). Data privacy for student grades in the Philippines: A comprehensive legal primer (updated 30 April 2025). Respicio & Co. Law Firm.
Sancon, R. J. S. (2023). Data privacy best practices of a local higher educational institution: A model for governance. IOER International Multidisciplinary Research Journal (Special Issue, June 2023), 9–16.
Torres-Hernández, N., & Gallego-Arrufat, M.-J. (2023). Pre-service teachers’ perceptions of data protection in primary education. Contemporary Educational Technology, 15(1), ep399.
Tupaz, E. F., Candelario, L. R., & Unarce, J. S. (2025, February 20). Philippines: The NPC’s advisory on child-oriented transparency. Gorriceta Africa Cauton & Sia.
UNICEF. (2024). Data protection in schools: Guidance for legislators, policy makers and schools. UNICEF Regional Office for Europe and Central Asia.
Wiefling, S., Janson, A., & Thielsch, M. T. (2023). Challenges in implementing GDPR-compliant data management: Insights from data protection officers in large organizations. Information Systems Frontiers, 25(3), 589–610.
