Since the implementation of the Personal Data Protection Act (PDPA) in Malaysia, issues related to data policy, security and privacy have gained significant media attention. However, the impact on Malaysian private universities remains understudied. This research explores how these issues affect a private university and proposes a framework to address them. Using qualitative methods, including interviews, content coding and thematic network analysis, the study identifies four key themes: data privacy, risks and concerns, data security and regulatory compliance. These findings provide valuable insights for creating a comprehensive framework focused on managing student data, particularly in relation to data privacy and security, with a focus on the Internet of Things (IoT) within university networks.