The Data Protection Act 1998

The Data Protection Act 1998.

1.5.1 Computing Related Legislation

Computing Related Legislation — Note 1 of 4

Candidates need to have an understanding of the need for and purpose of laws relating to the use of computers. Candidates should be familiar with the purpose and role of the Data Protection Act, candidates will need to understand the different rules that are within the DPA and how these impact the use of computers and the storage of data by organisations, this should include what organisations can and cannot do. Candidates need to understand how the regulations impact organisations and the use of computers and electronic communication. As the law changes over time, answers based on the law when the specification started or when the exam is sat are accepted.

What you need to know

The Data Protection Act controls how organisations collect, store and use personal data. The 1998 Act, named in the specification, set out eight principles. It has since been replaced by the Data Protection Act 2018 and UK GDPR, which are based on similar principles.

What to know

DPA 1998 principles: personal data must be (1) processed fairly and lawfully; (2) obtained only for specified, lawful purposes; (3) adequate, relevant and not excessive; (4) accurate and up to date; (5) not kept longer than necessary; (6) processed in line with the data subject's rights; (7) kept secure; (8) not transferred outside the EEA without adequate protection.
Data subjects have rights, including to see the data held about them, to have incorrect data corrected, and to prevent processing likely to cause damage or distress.
Organisations must take appropriate security measures, such as encryption, access controls and backups, and register with the Information Commissioner's Office.
The DPA 2018 and UK GDPR added stronger rights, such as the right to erasure, and much larger fines for breaches.

Key terms

Personal data: Data relating to a living individual who can be identified from it.

Exam technique

Tip:Answers based on the law when the specification was written (1998) or when the exam is sat (2018) are both accepted.
Tip:Apply the principles to the scenario, e.g. 'the gym must not keep members' bank details after they cancel, because data must not be kept longer than necessary'.

← Previous topicThe logic associated with D type flip flops, half and full adders1.4.3 Boolean Algebra Next note →The Computer Misuse Act 19901.5.1 Computing Related Legislation

Back to Computing Related Legislation