What is the name for the principle that personal data must not be kept for longer than it is needed?
Storage limitation
What is meant by 'data minimisation'?
Only the personal data that is needed for the stated purpose is collected and held
Which principle requires an organisation to be clear, open and honest with people about how their personal data will be used?
Lawful, fair and transparent processing
What is meant by 'the right to be forgotten'?
A person can ask an organisation to delete all of their personal data and the organisation must comply
Which principle requires an organisation to take responsibility for how it handles personal data and to be able to show that it complies with the other principles?
Accountability
What is meant by 'purpose limitation'?
Personal data is processed only for the specific purposes that were stated to the individual when it was collected
Which Act of Parliament sets out the main rules for how personal data must be handled in the UK?
The Data Protection Act 2018
In data protection law, what is a data subject?
The person that the personal data is about
What is meant by consent in data protection?
The person gives permission for an organisation to use their personal data
A company collects and uses customers' personal data without a valid legal reason and does not tell them how it will be used. Which principle is it failing to apply?
Personal data should be processed lawfully, fairly and openly
A company collects customers' email addresses to send delivery updates, then uses the same addresses to advertise a prize draw. Which principle is being broken?
Personal data should only be used for its original stated purpose
A job application form asks candidates for their marital status and religion, which are not needed for the job. Which data protection principle does this break?
Personal data should be limited to what is needed for the purpose
A gym's records show an out of date address for a member, but the gym has not corrected it. Which principle is the gym failing to apply?
Personal data should be accurate and kept up to date
A dental practice still holds the records of patients who moved away eight years ago and has no reason to keep them. Which principle is being broken?
Personal data should not be kept for longer than necessary
A customer wants to know what personal data a company holds about her. Which data subject right is she using?
The right to see and receive a copy of her data
A hotel sends a booking confirmation to all of its guests at once, so every guest can see the other guests' addresses. Which principle has the hotel failed to apply?
Personal data should be kept secure and protected from others
A UK retailer moves its customers' personal data to a server in a country that does not protect personal data to the same standard. Which principle has it broken?
Personal data should not be transferred to countries with less protection
A company that seriously breaks data protection law can be given a large fine. What is the maximum fine based on?
A percentage of the company's annual turnover
Customers' personal data is stolen from a company in a cyber attack. Why is this a serious problem for the customers?
Their personal data could be used to commit fraud in their name
What is the difference between purpose limitation and data minimisation?
Purpose limitation is about why data is used and data minimisation is about how much is collected
A customer asks an online shop to stop using her personal data to send her marketing emails, but she wants to keep her account. Which right is she using?
The right to object to how her data is used
We use cookies to enhance your experience. You can manage your preferences or learn more in our Cookie Policy.