Data Protection and Privacy Laws

Data protection laws regulate how organisations collect, store, use and share personal data. This lesson covers the two most important pieces of legislation for GCSE Computer Science: the General Data Protection Regulation (GDPR) / Data Protection Act 2018 and the Computer Misuse Act 1990.

---

Why Data Protection Laws Exist

In the digital age, organisations hold vast quantities of personal data — names, addresses, financial records, medical histories, browsing habits and more. Without legal protections:

• Companies could collect data without consent
• Personal information could be sold to third parties without the individual's knowledge
• There would be no obligation to keep data secure
• Individuals would have no rights over their own data

Data protection laws exist to balance the needs of organisations (which rely on data to operate) with the rights of individuals (who deserve control over their personal information).

---

The Data Protection Act 2018 and GDPR

The Data Protection Act 2018 (DPA) is the UK's main data protection law. It incorporates the General Data Protection Regulation (GDPR), which is an EU regulation that became part of UK law. The two work together.

Key Terminology