Personal data is any data that can identify a living person. The person it relates to is the data subject. Before an organisation shares someone's personal data with another organisation, it normally needs that person's consent. Passing it on without consent is both unlawful and unethical.
Responsible use of shared data means meeting legal, privacy and ethical requirements. It applies to both individuals and organisations. The organiser of a community choir should not pass members' email addresses to a music shop for advertising without asking the members first, even if the list is easy to copy.
Personal information is protected by law. The Data Protection Act 2018 and UK GDPR set the legal requirements for protecting personal data in the UK. There is also a duty of confidentiality, which reinforces the right to privacy: information given in confidence should not be passed on without permission. Privacy means personal data should be kept secure and seen only by the people who need it. Staff should only access records they are authorised to view, so a leisure centre receptionist should only open a customer's booking record to change a swimming lesson, not to look up a friend's home address.
Ethical use means not using data simply because it is available, especially if it was collected for a different purpose. An organisation should seek the data subject's permission before sharing their information. Ask whether sharing is necessary, fair and lawful, not just whether it is technically possible.
Legal action is an impact of a security breach where an organisation can be punished for failing to protect customer data or for breaking data protection law, such as the Data Protection Act or GDPR. It is not just a warning: it can lead to the organisation being fined, taken to court or sued. Legal action does not have to involve the police or a criminal case; it usually means a regulator or a customer taking action against the organisation.
The Information Commissioner's Office (ICO) is the UK regulator for data protection. It can investigate an organisation and, if it finds the law has been broken, issue a fine and take the organisation to court. It can also serve an enforcement notice ordering the organisation to change how it handles data, for example by improving security or deleting data it should not hold. Individuals whose data was affected can sue the organisation, asking for compensation for the harm or distress the breach caused.
Legal action is a serious impact because it combines money lost through fines and compensation with damage to the organisation's reputation. It also forces staff to spend time dealing with lawyers, investigations and legal requirements instead of normal work.
For example, a holiday club that runs activity days for children holds medical details and emergency contacts. After a breach exposes these records, the ICO finds the club did not protect the data properly. It fines the club and orders it to change its security, and some parents sue for distress and receive compensation.
A cookie is a small text file that a website creates and stores on your device so the site can keep data about you. It is not a program, virus or malware; it is only a text file.
Cookies let a website recognise your device when you return. They can keep you signed in so you do not have to type your details again, keep items in a shopping basket until your next visit, and store preferences such as a larger text size or dark mode. They also allow personalised content and adverts based on what you did before.
Most cookies hold named-value pairs and a unique ID. A nature club's wildlife-recording site might store patch=woodland, month=May and an ID such as t6wn. The club keeps your list of sightings on its server. When you return, your browser sends the cookie back and the site uses the ID to find your sightings.
A first-party cookie is created and used by the same website you are visiting, usually for signing in, baskets and settings. Its scope is limited to that one site, so it is generally low risk.
A third-party cookie comes from a different organisation, such as an advertiser or analytics service, whose code is built into the page. These cookies follow users from site to site so adverts can be matched to them, or count how many visitors view each page.
| Feature | First-party cookie | Third-party cookie |
|---|---|---|
| Created by | The website you are visiting | Another organisation, such as an advertiser or analytics service |
| Scope | One website | Many websites |
| Typical use | Signing in, remembering settings, keeping a basket | Following activity across sites to choose adverts, measuring how a site is used |
You can manage or delete cookies in your browser settings. The difference matters because first-party cookies only relate to the one site that set them, while third-party cookies can follow your activity across many sites.
Cookies are small text files that websites save on your device. For the person using the device, cookies have several drawbacks.
Every cookie takes up a little storage space on your phone, tablet or computer. One cookie is tiny, but a browser that collects them from many sites over months can build up a large number. If the cookies are never deleted, that stored data can slow the device down over time and take up room you need for other files.
Tracking cookies record what you do online: the pages you open, the searches you make and the things you click. That activity can be used to build a picture of your habits and interests, and the picture can be used to target adverts at you. For example, an advertising company can place cookies on both a revision site and a gaming site. Together the cookies show that you have been reading about volcanoes and looking up cheat codes, so a profile of your interests can be built even though you did not choose to share that. Your privacy is reduced because your behaviour is being watched and recorded.
Cookies are stored as text files on your hard drive, and other people may be able to access them. If you lend your laptop to someone, or someone else gets into your files, they may be able to read the information a cookie holds. That is the security risk: the file can be read by the wrong person. Cookies are not programs, viruses or malware, so a virus is not the security risk here; the risk is that a stored text file is read by someone it should not be.
Not every problem caused by cookies is a drawback for the user. If visitors keep rejecting cookies and a shop loses the chance to show them adverts, that is a problem for the shop, not a drawback for the user.
A website must get your permission before it stores or reads information on your device. This information is usually in cookies — small text files — but the same rule covers other data saved by a site. The permission is called cookie consent.
Cookies can remember your login, basket or preferences, but they can also track what you do across websites so adverts can target you. Because the data is stored on your own device, the law gives you a say before that happens. The UK rule that sets this out is the Privacy and Electronic Communications Regulations (PECR), which grew out of the EU ePrivacy Directive. A site should not place non-essential cookies, such as advertising or tracking cookies, until you have agreed. Cookies the site needs in order to work, such as one that keeps you logged in, are essential, so those do not need your consent.
A cookie banner is the message that appears when you visit a site. It explains what cookies the site wants to use and asks you to accept or reject them. Clicking accept gives the website permission to store cookies on your device, often including advertising and tracking cookies. Your consent must be a clear action: a site cannot treat you as agreeing just because you carry on browsing, and boxes must not be pre-ticked. For example, a music streaming site might ask to use cookies that remember the playlists you have made and also show you adverts for concert tickets. If you reject, the site should not use those optional cookies.
Cookies are not illegal. Using them is legal when the site asks for consent and follows the rules.
Transactional data is data recorded from a transaction: a sale, a booking, or a customer using a loyalty card. It is not simply any data an organisation happens to hold — it is the record of a transaction taking place. It can be collected by the business the customer bought from, or by a card company that handles the payment.
Each record can hold what was bought, when and where it was bought, how often that customer buys, how much was spent, and customer details. Loyalty card data is transactional data too, and because the card is linked to a named customer it can also reveal customer demographics and shopping habits.
Transactional data is analysed to find trends and patterns — general changes or repeated behaviour found by looking at data over time — and customer demographics, the characteristics of customers that help an organisation understand who they are.
For example, a garden centre records every till transaction. Looking back over one spring, the manager finds that Saturday mornings are busiest and need extra staff, that the lavender range sells least, that takings are highest in May, that the town-centre shop sells far more bedding plants than the out-of-town one, and that most customers come from two nearby villages. Those are patterns and demographics in action. The centre can reorder stock, cut back on the poor seller, discount quiet weekday afternoons, advertise in a village it is not yet reaching, and run a planting workshop on a quiet weekday. Displaying the figures in graphs makes these patterns easier to spot than reading a long list of records.
# Plant sales recorded at a garden centre across one Sunday
sales = ["shrub", "lavender", "shrub", "bird feeder", "shrub", "bird feeder", "shrub"]
print("Transactions recorded:", len(sales))
for item in ["shrub", "bird feeder", "lavender"]:
print(item, "sold", sales.count(item), "times")Output:
Transactions recorded: 7
shrub sold 4 times
bird feeder sold 2 times
lavender sold 1 timesAnalysis is not free: staff may need to be employed to extract and analyse the data, which adds cost. The data must also be accurate — errors in transactional data lead to bad decisions, such as ordering 500 extra umbrellas because a mistyped quantity made them look popular.
A discount or special offer helps the customer rather than the business, so it is not a benefit of transactional data to the organisation.
Data subject rights are the legal rights of the person a record is about, called the data subject. An organisation must respect these rights as part of data protection; they are not optional good practice.
Subject access means you can ask to see all the personal data an organisation holds about you and get copies. For example, a youth theatre group must show a member the contact details and attendance notes it keeps about them. If an organisation refuses to let someone see or obtain copies of their data, it breaks their subject access rights.
The right to be informed means you must be told how your data is used, including whether it is shared or sold. A puzzle app that passes your username to an advertising company should explain this clearly.
Consent is your permission for how your data is used. You also have the right to object to processing, such as asking a music streaming service to stop using your listening history to choose adverts for you.
The right to be forgotten lets you ask an organisation to delete all your personal data. The organisation must act if it has no further use for the data, or if you object to it being used for marketing. This is a right you must request; it is not automatic.
Breach notification means you have the right to be told if there is a breach of your data that is likely to put you at risk. If a climbing centre loses a tablet holding members' emergency contact details, it must tell the people affected when the loss is likely to put them at risk.