The way organisations handle personal data is governed by strict laws. Understanding these is essential for anyone working with computer systems.
Definition
The Data Protection Act 2018 (incorporating GDPR) is UK legislation that governs how personal data must be collected, stored, processed, and protected.
Definition
Personal data is any information that can identify a living individual, either directly or indirectly. This includes names, addresses, email, IP addresses, photos, and more.
The Seven Principles
Key Point
| GDPR principle | What it means in practice |
|---|---|
| 1. Lawfulness, Fairness, Transparency | Process data lawfully/fairly; tell people how data is used; no deception |
| 2. Purpose Limitation | Collect for explicit purposes only; no incompatible reuse without notice |
| 3. Data Minimisation | Collect only necessary data; avoid "just in case" collection |
| 4. Accuracy | Keep data accurate and up to date; correct/delete inaccurate records |
| 5. Storage Limitation | Keep data only as long as needed; apply retention and secure deletion |
| 6. Integrity & Confidentiality | Protect data from unauthorised access/loss with appropriate security controls |
| 7. Accountability | Be able to demonstrate compliance with policies, records, and governance |
Individual Rights
Key Point
| Data subject right | What it allows |
|---|---|
| Right to be informed | Know what data is held and why |
| Right of access | Request a copy of personal data (Subject Access Request) |
| Right to rectification | Correct inaccurate data |
| Right to erasure | Request deletion in certain circumstances |
| Right to restrict processing | Limit how data is used |
| Right to data portability | Receive data in machine-readable form |
| Right to object | Object to certain processing activities |
| Rights re: automated decisions | Avoid solely automated decisions in relevant cases |
Example
Scenario: A user requests access to their data from a social media company.
The company must:
• Respond within one month
• Provide all personal data held
• Explain how the data is used
• Not charge a fee (in most cases)
• Verify the requester's identity
The company must:
• Respond within one month
• Provide all personal data held
• Explain how the data is used
• Not charge a fee (in most cases)
• Verify the requester's identity
The Eight Principles of the 1998 Act
The specification names the Data Protection Act 1998, which the 2018 Act replaced. Past mark schemes list the principles in the wording of the 1998 Act, so learn them in this form as well.
Key Point
| Principle | Personal data must be |
|---|---|
| 1 | Processed fairly and lawfully |
| 2 | Collected and used only for the purpose it was collected for |
| 3 | Adequate, relevant and not excessive |
| 4 | Accurate and kept up to date |
| 5 | Kept for no longer than necessary |
| 6 | Processed in accordance with the rights of the data subject |
| 7 | Kept secure |
| 8 | Not transferred to a country outside the European Economic Area unless that country gives it adequate protection |