Data Protection Legislation
Computer ScienceΒ· Unit 7: Ethics and ownershipΒ· 15 min read
1. Core Data Protection Principlesβ β ββββ± 5 min
Most modern data protection regimes (referenced in CIE exams, including GDPR and UK DPA 2018) are built on core mandatory principles that govern personal data handling.
Data Protection Principles
Mandatory rules that organisations must follow when processing personal data, designed to protect individual rights
Example:
A requirement to collect only the minimum data needed for a stated purpose
Lawfulness, fairness and transparency: Processing must be legal, fair and clear to the data subject
Purpose limitation: Data can only be collected for specified, explicit, legitimate purposes
Data minimisation: Only collect the minimum data required for the stated purpose
Accuracy: Data must be kept accurate and up to date
Storage limitation: Only keep data for as long as it is needed
Integrity and confidentiality: Data must be kept secure from unauthorised access or loss
Accountability: The controller is responsible for complying with all principles
A fitness app wants to collect users' medical history to personalise workout plans. Which two core principles are most relevant to this data collection? Explain your answer.
- 1
Step 1: The two most relevant principles are data minimisation and purpose limitation.
- 2
Step 2: For purpose limitation: The principle is satisfied if the app clearly discloses that data is collected for personalising workouts, and does not use it for any other undisclosed purpose.
- 3
Step 3: For data minimisation: The app should only collect the specific medical information relevant to workout planning, and not collect unnecessary additional personal data.
Exam tip:
Exam questions often ask for 2-3 principles for a scenario, so memorise all 7
2. Stakeholder Roles & Obligationsβ β β βββ± 5 min
Data protection law assigns different legal roles with different obligations. All parties handling personal data have clear responsibilities to protect data subjects' rights.
Role | Key Legal Obligations |
|---|---|
Data Controller | Determine purpose of processing, comply with all principles, respond to subject requests |
Data Processor | Process data only per controller instructions, keep data secure, maintain records |
Data Subject | Exercise legal rights over their own personal data |
A school uses a third-party payment platform to process student tuition fees. Identify the role of the school, the payment platform, and the student.
- 1
Step 1: The school decides that it needs to collect payment data to collect tuition fees, so it is the data controller.
- 2
Step 2: The third-party payment platform only processes the payment data on behalf of the school, following the school's instructions, so it is the data processor.
- 3
Step 3: The student whose personal payment data is collected and stored is the data subject.
Exam tip:
Differentiating between data controllers and processors is a very common exam question
3. Rights of Data Subjectsβ β ββββ± 4 min
Data protection legislation grants a set of legal rights to individuals over their own personal data. Organisations are legally required to comply with valid requests made under these rights.
Right of access: Request a copy of all personal data an organisation holds about you
Right to rectification: Request correction of inaccurate or incomplete data
Right to erasure (right to be forgotten): Request deletion of data in specific circumstances
Right to data portability: Request a machine-readable copy of your data to transfer to another organisation
Right to object: Object to processing of your data for marketing or other purposes
A customer finds that a bank has the wrong phone number on their account. Which right allows them to correct this information?
- 1
Step 1: The issue is that the existing personal data held by the bank is inaccurate.
- 2
Step 2: The right to rectification explicitly gives data subjects the right to correct inaccurate personal data held by an organisation.
- 3
Step 3: The correct right is the right to rectification.
Exam tip:
You will often be asked to match a right to a given scenario, so learn what each right covers
4. Implications for IT System Designβ β β βββ± 6 min
Complying with data protection legislation requires specific design choices for IT systems that handle personal data. Compliance is usually built into systems from the start rather than added later.
Privacy by design: Build privacy protections into systems from the initial design stage
Access controls: Restrict access to personal data to only staff that need it
Audit logging: Record all access to personal data to detect unauthorised use
Encryption: Encrypt personal data at rest and in transit to prevent breaches
Deletion capability: Systems must allow complete deletion of data when required
Explain how privacy by design applies to a new online shopping website.
- 1
Step 1: Privacy by design means integrating privacy into all stages of development, rather than adding it after launch.
- 2
Step 2: For an online shopping website, this would include default settings that only collect the minimum customer data needed to process orders, do not share data with third parties by default, and give customers easy access to update their privacy preferences.
- 3
Step 3: This approach ensures the website is compliant from launch, and reduces the risk of penalties or data breaches.
5. Common Pitfalls
Wrong move:
Confusing data controllers with data processors
Why:
Students often mix up the roles, as both handle personal data
Correct move:
Remember that controllers make all decisions about why and how data is processed, while processors only act on the controller's instructions
Wrong move:
Claiming the right to erasure is always applicable
Why:
Many students think data subjects can demand deletion of their data in any situation
Correct move:
Understand that the right to erasure is not absolute, it only applies when data is no longer needed or processing is unlawful
Wrong move:
Forgetting the accountability principle
Why:
Students often memorise the first six principles and leave out the final one
Correct move:
Always include accountability as a core principle, as it is a required element of modern data protection law
Wrong move:
Stating data protection applies to all stored information
Why:
Students often extend coverage to anonymised or non-personal organisational data
Correct move:
Remember data protection only applies to personal data relating to an identifiable living individual
Wrong move:
Claiming storage limitation sets a fixed maximum storage time
Why:
Students often think data can never be kept for more than a year or two
Correct move:
Storage limitation requires data is only kept for as long as needed for the stated purpose, which can be years for legitimate uses like accounting
6. Quick Reference Cheatsheet
Category | Key Exam Reference Points |
|---|---|
Core Principles | Lawful/Fair/Transparent, Purpose Limitation, Data Minimisation, Accuracy, Storage Limitation, Integrity/Confidentiality, Accountability |
Stakeholder Roles | Controller: decides processing purpose; Processor: processes for controller; Subject: individual data owner |
Key Data Subject Rights | Access, Rectification, Erasure, Portability, Objection |
IT System Requirements | Privacy by design, Access control, Encryption, Audit logs, Secure deletion capability |
When this came up on past exams
AI-estimated based on syllabus patterns β cross-check with official past papers for accuracy. Use only as revision-focus signals.
- 2022 Β· 12
Explain 3 data protection principles
- 2023 Β· 11
Describe rights of a data subject
- 2021 Β· 13
Differentiate controller vs processor
Going deeper
What's Next
Data protection legislation is a core legal topic in CIE 9618 Unit 7, and you will encounter it in scenario-based questions in Paper 1, as well as when evaluating the ethical impact of IT systems in extended response questions and coursework. This topic also forms the foundation for understanding modern cyber security governance and ethical data handling, which are recurring themes across the A-Level Computer Science syllabus.