All of these findings point to the need for better communication with students about their personal data privacy and information security. In response to items asking how they learn about personal data privacy and security and related institutional policies, respondents indicated that they are most likely to rely on information and training provided by their institutions rather than searching for that information online or learning about it from other sources (see figure 5). Thus, privacy and information security leaders have an opportunity to bolster proactive programs and campaigns that teach students about relevant institutional policies, an action that is recommended in the 2021 EDUCAUSE Horizon Action Plan: Privacy.

Institutional leaders can take the following steps:

• Make your students active participants in data privacy and information security. Ask your students what they know about your institution's data privacy and information security policies and practices, and ask them what they want to see in those policies and practices.
• Create or bolster campaigns that inform students about institutional data privacy and information security policies and practices. Be sure that you consider where and how your students like to learn about institutional resources and policies.
• Find resources for navigating information security careers in the EDUCAUSE Information Security Professional Pathway.
• Join leaders in information security in an upcoming EDUCAUSE Learning Lab.
• Check out the EDUCAUSE New Managers Institute for Cybersecurity Professionals.