To find a balance between learning analytics research and individual privacy, learning analytics initiatives need to appropriately address ethical, privacy, and data protection issues. A range of general guidelines, model codes, and principles for handling ethical issues and for appropriate data and privacy protection are available, which may serve the consideration of these topics in a learning analytics context. The importance and significance of data security and protection are also reflected in national and international laws and directives, where data protection is usually considered as a fundamental right. Existing guidelines, approaches, and regulations served as a basis for elaborating a comprehensive privacy and data protection framework for the LEA's BOX project. It comprises a set of eight principles to derive implications for ensuring ethical treatment of personal data in a learning analytics platform and its services. The privacy and data protection policy set out in the framework is translated into the learning analytics technologies and tools that were developed in the project and may be used as best practice for other learning analytics projects.