The loyalty card
A shop says: "Join our card and get a free coffee."
The form asks for your name, phone number, home address, date of birth and email.
You want the free coffee. But does the shop need all of that? What will it do with it? How long will it keep it?
A UK law gives you answers.
Key words
| Word | What it means | Example |
|---|---|---|
| Personal data | Any information about a living person that can show who they are. | A name, an email, a photo |
| Data subject | The person the data is about. | You, on a shop form |
| GDPR | The General Data Protection Regulation: rules on how personal data is used. | UK GDPR |
| Process | To do anything with data: collect it, store it, use it or share it. | Saving a name on a form |
| Principle | A basic rule that guides what you do. | Only keep data you need |
| ICO | The Information Commissioner's Office: the UK body that checks the rules. | It can fine a company |
| Data breach | When personal data is lost, stolen or seen by the wrong people. | A stolen laptop with customer files |
| Encryption | Scrambling data so only the right person can read it. | A locked laptop disk |
| Consent | A clear yes from a person, freely given. | Ticking a box that is not ticked for you |
The cells students fill in are left blank in this preview.
Quick check: is it personal data?
Have a go
Quick check: is it personal data?
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Why the law exists
Organisations hold huge amounts of data about us. Without rules they could use it in unfair ways, lose it or sell it.
In the UK, the main rules are the UK GDPR and the Data Protection Act 2018. Their purpose is to protect people's privacy and give them control over their personal data.
The ICO checks that organisations follow the rules.
The seven principles of UK GDPR
| Principle | In plain words | Example |
|---|---|---|
| Lawful, fair and open | Have a good reason. Be honest about what you do | A shop says why it wants your phone number |
| Limited purpose | Use data only for the reason you gave | Delivery addresses are not sold to advertisers |
| Data minimisation | Ask only for what you need | A quiz app does not need your home address |
| Accuracy | Keep data correct and up to date | Fix a wrong name when someone tells you |
| Limited storage | Do not keep it longer than you need | Delete old customer records |
| Security | Keep it safe from loss and theft | Use strong passwords and encryption |
| Accountability | Be able to show that you follow the rules | Keep records. Name someone responsible |
The cells students fill in are left blank in this preview.
Seven or eight?
data-callouts.note.label
The T Level course says "eight principles". Today the UK GDPR has seven. The old Data Protection Act 1998 had eight. The ideas are the same. Learn the seven, then look at the old eight in the next table. Ask your teacher which list your exam uses.
The old eight principles, side by side
| Old principle (1998) | Where it sits now |
|---|---|
| Fairly and lawfully processed | Lawful, fair and open |
| Processed for limited purposes | Limited purpose |
| Adequate, relevant and not excessive | Data minimisation |
| Accurate and up to date | Accuracy |
| Not kept longer than needed | Limited storage |
| Processed in line with the person's rights | Rights are now a full part of the law |
| Kept secure | Security |
| Not sent to countries without proper protection | Rules on sending data abroad |
The cells students fill in are left blank in this preview.
What it means for organisations and people
For organisations: have a lawful reason to hold data. Keep it safe. Tell the ICO about a serious breach. A company that breaks the rules can be fined, and it can lose the trust of its customers.
For people: you can ask to see your data. You can ask to correct it, and in some cases to delete it. You can complain to the ICO. You may ask for money if you are harmed.