Security of Personal Data

Personal data is information about a living person that can identify them, which makes it valuable and worth protecting. Keeping it secure means protecting it from four things: unauthorised access (someone seeing or copying it who has no right to), loss, damage and theft. The Data Protection Act 2018 makes the organisation that holds the data responsible for this, and it prohibits failing to keep personal data secure — an organisation that loses or leaks personal data has broken the law even if nobody ever uses the data afterwards.

Protecting it while it is held

The data should be kept where it is protected from anyone who has no right to see it, and from being lost or altered by accident. For example, a junior tennis club keeps its members' contact details in one club account rather than on every coach's phone. If a coach then emails the whole membership list to a parent by mistake, the club has failed to keep the data secure, even if the parent deletes it without reading a word.

Disposing of it securely

When the data is no longer needed it must be disposed of securely. Deleting a file in the normal way may only hide it, so data has to be destroyed so it cannot be recovered by someone who should not have it, and paper records are shredded rather than put in a general bin. When a tennis club membership ends, that member's paper form should go through the shredder and their entry in the club account should be deleted for good, not just moved to a 'past members' folder.

The Act does not stop an organisation holding personal data: it controls how the data is handled and how it is destroyed afterwards. The person the data is about is not responsible for keeping it safe — the organisation that holds it is. Paper records are covered as well as computer files, so a box of completed paper forms left where anyone can read them is just as much a failure as a leaked computer file.