Data privacy assessment : an exemplary case for higher education institutions