Data Protection Act Scenarios

Scenario questions give you a short story about an organisation and ask you to spot which rule of the Data Protection Act 2018 has been broken. Name the specific rule the facts break, then explain the legal issue this creates for the organisation that holds the data.

A worked example

A weekend art club keeps members' names and the sessions they attend in a spreadsheet on the club laptop. A volunteer wants to finish the register at home, so they email the spreadsheet to their own personal email address. Nobody at the club agreed to this, and the file now sits in an account the club cannot see or control.

The specific rule broken is that personal data must be kept secure, protected from loss and from being seen by people who should not have it: the Act prohibits failing to keep personal data secure. The facts show the failure, because the spreadsheet was copied out of the club's system and sent to an account outside the club's control, where other people might be able to open it. The legal issue belongs to the club, not only the volunteer. The Act makes the organisation responsible for the personal data it holds, so the club has failed in its duty to keep that data safe, and anyone who opens that email account could read or copy the members' details without the club knowing. What that person does next is a separate offence; the club's failure is that it did not keep the data secure.

Linking facts to the Act

Use the details in the story as evidence: point to what was held, what was done with it and what went wrong.

• Weak: "Technology is risky because data can be lost." This could apply to any story and names no rule.
• Strong: "The club broke the rule that personal data must be kept secure because a volunteer emailed the members' spreadsheet to a personal address outside the club's control." This ties the facts to the Act.

You do not need to list every rule. Pick the one the scenario actually demonstrates and explain why the organisation has a legal problem.