This paper sought to establish the extent to which users' legitimate rights are safeguarded in Learning Management Systems (LMS); specifically, on the Blackboard system used for teaching at Sorbonne University, Abu Dhabi (SUAD). First, the users' legitimate rights that required protection were identified. Second, the security and privacy guarantees afforded by Blackboard were assessed. Finally, policy gaps and technological deficiencies that undermine the protection of users' legitimate rights were identified. The study adopted a qualitative research approach and a case study research design. Data was collected through content analysis, document review and interviews. The research revealed that to a large extent the "Blackboard" LMS safeguarded most of the users' legitimate rights. However, the system is silent on some legitimate rights, such as storage limitation and data sharing arrangements. Further, information emerged that revealed "Blackboard's" privacy practices are largely informed by educational institutions using its products. The study concluded that safeguarding user's legitimate rights is a collective responsibility between the learning management services providers and the educational institutions. As such, there is need for educational institutions using "Blackboard" and other learning management systems to craft robust data protection regimes.