Almugamisi, Haifa; (2025) Multiple Perspectives of Data Breaches in Higher Education Institutions (HEI): A Case of Universities In Saudi Arabia. Doctoral thesis (Ph.D), UCL (University College London).

Preview

Text Almugamisi_10205987_Thesis_redacted.pdf Download (3MB) | Preview

Abstract

This study investigates the significant risks posed by data breaches within Saudi organisations, with a particular emphasis on higher education (HE) institutions due to their extensive collection of personal data and early adoption of new technologies. It explores the multidimensional impacts of such breaches, including technical, organisational, and personal dimensions, as well as emotional aspects. The research aims to investigate the causes, risks, policies, mitigation strategies, and perspectives of a range of stakeholders concerning data protection. It seeks to understand the cultural complexities of data security in Saudi Arabia by utilising a convergent mixed-methods approach. The study examines two prominent universities for the case study contexts: King Saud University (KSU) and Taibah University (TaibahU). Through interviews with 15 managers and surveys distributed to 191 students and 70 faculty members, this research achieves a holistic understanding of personal data protection and captures the diverse risks and impacts of data breaches. Semi-structured interviews and a survey containing both closed and open-ended questions were used as data collection tools. The research was carefully designed to account for and mitigate power imbalances and potential researcher bias. In addition, it considered the challenges of collecting data on a sensitive and complex topic, namely, data security. The findings reveal multiple risks in HE institutions, technical (e.g., malicious attacks and phishing), organisational (e.g., reputational damage), and personal (e.g., emotional responses including fear, anger, anxiety, shock) impacts. The study identified the critical impact of data breaches and the need for Saudi HE institutions to adopt the recently established national framework for data protection. This necessitates updating security policies, categorising data, engaging stakeholders in data processing, establishing structured protocols for managing breaches, and devising various mitigation strategies, such as offering compensation. Additionally, the research emphasises the importance of understanding personal risk, including the cultural significance of 'over trust', which influences the Saudi data security environment. Consequently, it proposes that universities should implement robust security protocols that consider technical, organisational, and personal (emotional) aspects. A holistic response is required, including comprehensive data governance frameworks, clear response plans for data risks, and security training programmes at all organisational levels. The study highlights the importance of understanding cultural and social contexts when establishing data governance programmes. This work provides valuable insights for developing and delivering data protection and governance programmes within the Saudi context. Furthermore, it offers recommendations for the global university sector. Finally, the research framework presents new considerations for navigating across cultural boundaries and languages while addressing subject sensitivities.

Download activity - last month

Export as XMLCSVJSON

Download activity - last 12 months

Export as XMLCSVJSON

Downloads by country - last 12 months

Export as CSVXMLJSON

Archive Staff Only

View Item