American institutions of higher education that have operations in the European Union, or that provide services to E.U. residents, may be subject to a new General Data Protection Regulation that goes into effect on May 25, 2018.

While the full scope of the regulation is not entirely clear, the rule appears likely to apply to a significant number of institutions of higher education, including colleges and universities that have E.U. residents enrolled in distance education programs, students studying abroad in E.U. countries, or applicants from within E.U. countries. However, E.U. citizens attending U.S.-based institutions do not appear to be covered by the regulation during the period of time they are residing in the United States.

Institutions are advised to review the E.U.’s regulation and, if applicable, begin taking steps to implement these new requirements before the deadline. For more information, EDUCAUSE has developed a set of key takeaways and answers to pressing questions raised by the new regulation.