1. Lawful and Transparent Data Collection

• Obtain informed consent from students before collecting any personal data (e.g., passport numbers, transcripts, family information).
• Clearly state the purpose for data collection and how it will be used.

2. Purpose Limitation

• Use student data solely for the purposes outlined in the service agreement (e.g., school applications, visa processes).
• Do not share data with third parties without prior written consent, except where required by law.

3. Data Minimisation

• Collect only the data that is directly relevant and necessary for processing applications or supporting students.

4. Accuracy

• Keep student data accurate and up to date.
• Promptly correct or delete outdated or inaccurate information upon request.

5. Storage Limitation

• Retain student records only for the duration required by law, institutional partnership terms, or legitimate educational need.
• Securely delete or anonymise student data once retention is no longer required.

6. Data Security

• Implement physical, digital, and administrative safeguards:
  • Password-protected databases
  • Encrypted communications
  • Restricted staff access to sensitive data
• Train all staff on NDPR responsibilities and breach response procedures.

7. Breach Notification

• Report any data breaches to SRAAA and NITDA within 72 hours.
• Inform affected students and institutions immediately with actionable support guidance.

8. Student Rights

Students have the right to:

• Access their personal data
• Request corrections or deletion
• Withdraw consent
• File a complaint if their data rights are violated