The student’s independent work, often in the form of a thesis, plays an important role in higher education at Swedish universities. However, since the GDPR came into effect in 2018, some Swedish universities have limited their students’ processing of sensitive personal data, while other universities have not. This thesis studies the reasons behind the regulations, in relation to the principle of academic freedom as well as research ethics and the universities’ mission of providing higher education and research to society. Using these concepts as a theoretic framework, the thesis then analyses how ten Swedish universities position themselves in regards to their students processing personal data, and complements the analysis with two semi-structured interviews with representatives of library and information science educations at two universities. The thesis explores the boundaries and the grey areas between the concepts of education and research, and discusses the possible implications and consequences of applying limitations to what students can and cannot research, for higher education in general and for library and information science in particular. The conclusion is that the question of whether students should be allowed to process personal data is as much a question of democracy as of academy, and that a further, critical discussion is needed within the academic sector.