Prove it
A parent asks a club: "How do you look after my child's details?" The leader says "carefully". That is not an answer.
A good analyst can explain, in plain words and with the right terms, what was done and which law it follows. This lesson shows how.
Key words
| Word | What it means | Example |
|---|---|---|
| UK GDPR | The main UK law on how personal data may be collected and used. | Collect only what you need |
| Data Protection Act 2018 | The UK law that works with the UK GDPR and adds UK rules. | Sets up the ICO's powers |
| ICO | The Information Commissioner's Office, the UK regulator for data protection. | Takes breach reports |
| Personal data | Any data that can identify a living person. | A name and phone number |
| Data subject | The person the personal data is about. | A club member |
| Data breach | When personal data is lost, stolen or seen by the wrong people. | A lost memory stick |
| Lawful basis | A reason the law accepts for using personal data. | Consent |
| Encryption | Scrambling data so only people with the key can read it. | A locked file |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can summarise how data law and security rules were followed and explain safe use, online and offline.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
The seven principles in short
| Principle | In plain words |
|---|---|
| Lawfulness, fairness, transparency | Have a reason, be fair, be open |
| Purpose limitation | Use data only for the reason you gave |
| Data minimisation | Collect only what you need |
| Accuracy | Keep it correct and up to date |
| Storage limitation | Do not keep it for ever |
| Integrity and confidentiality | Keep it secure |
| Accountability | Be able to show what you did |
The cells students fill in are left blank in this preview.
People have rights too
A data subject may ask to see their data, to have errors fixed, and in some cases to have it deleted. They may object to some uses.
Sometimes personal data is lost or stolen in a way that puts people at risk. Then the ICO must be told within 72 hours of finding out. Rules change, so check the current guidance at ico.org.uk.
Try it: print a compliance summary
steps = ["lawful basis", "minimise", "secure", "retain", "report"]
done = ["lawful basis", "secure"]
for step in steps:
if step in done:
print(step + ": done")
else:
print(step + ": not done")
# Try it: add "minimise" to done and press Run.
A common mistake
Warning
Many people write "we follow GDPR" and stop. That proves nothing. A good summary names the step, the term and the evidence. For example: consent was recorded on the sign-up form.