Legislation relevant to Computer Science: The Data Protection Act 2018

The Data Protection Act 2018 governs how organisations can use the personal information of individuals. It protects people's data rights and sets rules for how data must be stored, used, and shared.

Key points

• Definition:Personal Data: any data that can be used to identify an individual, such as name, address, date of birth, phone number.
• Organisations must: store data securely, use it fairly/lawfully/transparently, not keep it longer than necessary, keep it accurate and up to date.
• Individuals have the RIGHT to: be informed how their data is used, request access to data held about them, have their data erased, request that processing stops.
• Exam Tip:Know both the ORGANISATION'S responsibilities (how they must handle data) AND the INDIVIDUAL'S rights (what they can request).
• Common Mistake:Only listing the organisation's duties. Examiners also want to see the individual's RIGHTS under the act.
• Exam Example:DPA applies when — a school publishes students' addresses online, a company shares personal data without permission, a firm stores customer data insecurely, or personal data is sold without consent.