Personal information is among the most significant assets for businesses today, and clear transactional rules are becoming increasingly important. Organizations, including universities, are charged with more responsibility than ever to protect the personal information used during the course of their business, specifically student data. The paper provides a broad contextual overview of the effects of data protection rules and presents a succinct, easy to digest introduction to the complex, often technical arena of student data management for universities. It highlights specific legal and ethical considerations on which universities, and particularly open distance learning institutions, will need to focus in order to ensure legislative and ethical compliance. Given the absence of precedent in South Africa, a comparative policy and practice review was applied to analyze available international legislation governing data privacy and protection to establish some of the trends, risks, and best practices.