The sign-up sheet
A cafe runs a food survey. The sheet asks for a name, an email, a home address and a favourite meal. Then the owner shares the whole sheet with a friend who sells sandwiches.
Nobody was hacked. Is the cafe in trouble? In the UK, it may well be. A data analyst has to know why.
Key words
| Word | What it means | Example |
|---|---|---|
| Personal data | Information about a living person who can be identified. | a name and an email |
| UK GDPR | The main UK law on personal data. GDPR stands for General Data Protection Regulation. | |
| Data Protection Act 2018 | The UK law that works with the UK GDPR and adds details. | |
| Data subject | The person the data is about. | |
| Principle | A main rule that other rules follow from. | |
| Lawful basis | A legal reason that allows you to use personal data. | |
| ICO | The Information Commissioner's Office. It enforces data protection law in the UK. | |
| Breach | Personal data lost, stolen or seen by people who should not see it. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can name the seven principles of UK data protection law and say which one a data analysis case breaks.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Which laws apply
Two laws work together in the UK. They are the UK GDPR and the Data Protection Act 2018.
In 2025 a new law, the Data (Use and Access) Act 2025, changed some details. The seven principles stayed the same. Check the ICO website for the latest changes.
The seven principles at work
| Principle | In plain words | In an analysis |
|---|---|---|
| Lawful, fair and open | Have a good reason and tell people | The survey says how answers will be used |
| Purpose | Use data only for the reason you gave | Sign-up emails are not used for adverts |
| Minimum | Collect only what you need | No home address in a food survey |
| Accurate | Keep data right and up to date | Fix a wrong age band |
| Kept only as long as needed | Delete it when the need ends | Survey rows go after the report is done |
| Safe and private | Protect it from loss and from wrong eyes | Passwords and locked folders |
| Accountable | Be able to show you follow the rules | Written policies and records |
The cells students fill in are left blank in this preview.
A reason to use the data
You also need a lawful basis. The UK GDPR lists them: consent, a contract, a legal duty, protecting a life, a public task and legitimate interests.
From 5 February 2026 the Data (Use and Access) Act 2025 adds a seventh ground, recognised legitimate interests. It covers a short list of listed purposes. Check the ICO guidance before you rely on it.
Check: principles and reasons
Have a go
Check: principles and reasons
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.