Data Protection
Data protection principles
Data protection principles are legal rules organisations must follow when processing personal data. In the UK they come from the UK GDPR and the Data Protection Act 2018.
The seven principles
| Principle | What it requires | What breaks it |
|---|---|---|
| Lawful processing | Have a valid lawful basis, obey other laws, use data fairly and openly, and never in unduly harmful, unexpected or misleading ways. | A company collects details with no lawful basis and hides what it really uses them for. |
| Purpose limitation | Be clear from the start why data is needed, record those purposes and tell people. A new purpose needs compatibility, consent or a clear legal obligation. | A library takes an address to post a replacement card, then uses it to send fundraising letters without consent. |
| Data minimisation | Collect only data that is adequate, relevant and necessary. | A free coding club asks for your home address and a parent's salary, which it does not need. |
| Accuracy | Take reasonable steps to keep data correct and not misleading, update it, fix or erase inaccurate data quickly and consider challenges carefully. | A swimming club is told an emergency contact changed but keeps the old number. |
| Storage limitation | Keep data no longer than necessary, justify retention in policy, then review and erase or anonymise it. Data subjects can challenge retention and ask for erasure when data is no longer needed. | A repair shop plans to keep every customer's address for 50 years "just in case". |
| Protected | Use appropriate security measures. | A tutoring company leaves student records in a shared folder any staff member can open. |
| International transfers | Do not transfer data to countries with less protection. | A shop moves customer records to a server in a country with weaker protection and no safeguards. |
Anonymising data removes identifying details so it is no longer personal data. A bus company, for example, can turn its journey records into anonymous counts of passengers at each stop, and then use those counts freely.
Practise this
Pearson BTEC Digital Information Technology · Data protection