# Data Protection Legislation

> Computer Science · CIE A-Level 9618
> Source: https://www.owlsprep.com/study/cie-9618-u7-data-protection-legislation/

This module covers core requirements of data protection legislation aligned to CIE 9618 expectations, including key principles, stakeholder roles, rights and obligations for IT data handling.

**Prerequisites:** [Basic understanding of data processing in computer systems](https://www.owlsprep.com/study/cie-9618-u1-data-representation/)

## Learning objectives

- Explain the key principles of data protection legislation
- Differentiate between roles and obligations of data protection stakeholders
- Outline the legal rights of data subjects
- Analyse how data protection requirements impact IT system design

## Core Data Protection Principles

Most modern data protection regimes (referenced in CIE exams, including GDPR and UK DPA 2018) are built on core mandatory principles that govern personal data handling.

**Data Protection Principles** — Mandatory rules that organisations must follow when processing personal data, designed to protect individual rights

*Example:* A requirement to collect only the minimum data needed for a stated purpose

- Lawfulness, fairness and transparency: Processing must be legal, fair and clear to the data subject
- Purpose limitation: Data can only be collected for specified, explicit, legitimate purposes
- Data minimisation: Only collect the minimum data required for the stated purpose
- Accuracy: Data must be kept accurate and up to date
- Storage limitation: Only keep data for as long as it is needed
- Integrity and confidentiality: Data must be kept secure from unauthorised access or loss
- Accountability: The controller is responsible for complying with all principles

**Worked example:** A fitness app wants to collect users' medical history to personalise workout plans. Which two core principles are most relevant to this data collection? Explain your answer.

1. Step 1: The two most relevant principles are data minimisation and purpose limitation.
2. Step 2: For purpose limitation: The principle is satisfied if the app clearly discloses that data is collected for personalising workouts, and does not use it for any other undisclosed purpose.
3. Step 3: For data minimisation: The app should only collect the specific medical information relevant to workout planning, and not collect unnecessary additional personal data.

> **Exam tip:** Exam questions often ask for 2-3 principles for a scenario, so memorise all 7

## Stakeholder Roles & Obligations

Data protection law assigns different legal roles with different obligations. All parties handling personal data have clear responsibilities to protect data subjects' rights.

| Role | Key Legal Obligations |
| --- | --- |
| Data Controller | Determine purpose of processing, comply with all principles, respond to subject requests |
| Data Processor | Process data only per controller instructions, keep data secure, maintain records |
| Data Subject | Exercise legal rights over their own personal data |

**Worked example:** A school uses a third-party payment platform to process student tuition fees. Identify the role of the school, the payment platform, and the student.

1. Step 1: The school decides that it needs to collect payment data to collect tuition fees, so it is the data controller.
2. Step 2: The third-party payment platform only processes the payment data on behalf of the school, following the school's instructions, so it is the data processor.
3. Step 3: The student whose personal payment data is collected and stored is the data subject.

> **tip**
>
> Remember: Controllers make the decisions, processors do the work for controllers.

> **Exam tip:** Differentiating between data controllers and processors is a very common exam question

## Rights of Data Subjects

Data protection legislation grants a set of legal rights to individuals over their own personal data. Organisations are legally required to comply with valid requests made under these rights.

- Right of access: Request a copy of all personal data an organisation holds about you
- Right to rectification: Request correction of inaccurate or incomplete data
- Right to erasure (right to be forgotten): Request deletion of data in specific circumstances
- Right to data portability: Request a machine-readable copy of your data to transfer to another organisation
- Right to object: Object to processing of your data for marketing or other purposes

**Worked example:** A customer finds that a bank has the wrong phone number on their account. Which right allows them to correct this information?

1. Step 1: The issue is that the existing personal data held by the bank is inaccurate.
2. Step 2: The right to rectification explicitly gives data subjects the right to correct inaccurate personal data held by an organisation.
3. Step 3: The correct right is the right to rectification.

> **Exam tip:** You will often be asked to match a right to a given scenario, so learn what each right covers

## Implications for IT System Design

Complying with data protection legislation requires specific design choices for IT systems that handle personal data. Compliance is usually built into systems from the start rather than added later.

- Privacy by design: Build privacy protections into systems from the initial design stage
- Access controls: Restrict access to personal data to only staff that need it
- Audit logging: Record all access to personal data to detect unauthorised use
- Encryption: Encrypt personal data at rest and in transit to prevent breaches
- Deletion capability: Systems must allow complete deletion of data when required

**Worked example:** Explain how privacy by design applies to a new online shopping website.

1. Step 1: Privacy by design means integrating privacy into all stages of development, rather than adding it after launch.
2. Step 2: For an online shopping website, this would include default settings that only collect the minimum customer data needed to process orders, do not share data with third parties by default, and give customers easy access to update their privacy preferences.
3. Step 3: This approach ensures the website is compliant from launch, and reduces the risk of penalties or data breaches.

## Common pitfalls

- **Wrong:** Confusing data controllers with data processors
  - Why it fails: Students often mix up the roles, as both handle personal data
  - Correct: Remember that controllers make all decisions about why and how data is processed, while processors only act on the controller's instructions
- **Wrong:** Claiming the right to erasure is always applicable
  - Why it fails: Many students think data subjects can demand deletion of their data in any situation
  - Correct: Understand that the right to erasure is not absolute, it only applies when data is no longer needed or processing is unlawful
- **Wrong:** Forgetting the accountability principle
  - Why it fails: Students often memorise the first six principles and leave out the final one
  - Correct: Always include accountability as a core principle, as it is a required element of modern data protection law
- **Wrong:** Stating data protection applies to all stored information
  - Why it fails: Students often extend coverage to anonymised or non-personal organisational data
  - Correct: Remember data protection only applies to personal data relating to an identifiable living individual
- **Wrong:** Claiming storage limitation sets a fixed maximum storage time
  - Why it fails: Students often think data can never be kept for more than a year or two
  - Correct: Storage limitation requires data is only kept for as long as needed for the stated purpose, which can be years for legitimate uses like accounting

## Cheatsheet

| Category | Key Exam Reference Points |
| --- | --- |
| Core Principles | Lawful/Fair/Transparent, Purpose Limitation, Data Minimisation, Accuracy, Storage Limitation, Integrity/Confidentiality, Accountability |
| Stakeholder Roles | Controller: decides processing purpose; Processor: processes for controller; Subject: individual data owner |
| Key Data Subject Rights | Access, Rectification, Erasure, Portability, Objection |
| IT System Requirements | Privacy by design, Access control, Encryption, Audit logs, Secure deletion capability |

## What's next

Data protection legislation is a core legal topic in CIE 9618 Unit 7, and you will encounter it in scenario-based questions in Paper 1, as well as when evaluating the ethical impact of IT systems in extended response questions and coursework. This topic also forms the foundation for understanding modern cyber security governance and ethical data handling, which are recurring themes across the A-Level Computer Science syllabus.

- [Digital divide](https://www.owlsprep.com/study/cie-9618-u7-digital-divide/)
- [Databases](https://www.owlsprep.com/study/cie-9618-u8-overview/)
- [Database concepts](https://www.owlsprep.com/study/cie-9618-u8-database-concepts/)

---

From [OwlsPrep](https://www.owlsprep.com) — free study guides for A-Level, IB, AP and IGCSE, written against the official syllabus. Canonical page: https://www.owlsprep.com/study/cie-9618-u7-data-protection-legislation/