Explain personal data security and confidentiality

Resources → Subject Notes → Information Technology IT → Lesson Plan

5 eSecurity – Personal Data Security and Confidentiality

Learning Objective (AO1‑AO3)

Explain the concepts of personal data, security and confidentiality; analyse the main threats to personal data and the different types of malware; evaluate technical, organisational and legal controls (including their advantages and disadvantages); and apply this knowledge to everyday computing environments.

Key Definitions (AO1)

  • Personal Data: Any information that can identify an individual, directly or indirectly (e.g., name, address, ID number, biometric data).
  • Security: Measures taken to protect data from unauthorised access, alteration, loss or destruction.
  • Confidentiality: The principle that personal data must only be accessed by authorised persons for legitimate purposes.
  • Integrity: Ensuring data remains accurate and unaltered during storage, transmission and processing.
  • Availability: Ensuring authorised users can access data when required.
  • Malware: Malicious software designed to damage, disrupt or gain unauthorised access to computer systems (e.g., trojan, worm, ransomware).

Why Personal Data Security Matters (AO2)

  1. Prevents identity theft and financial fraud.
  2. Protects privacy rights under legal frameworks such as GDPR and the Data Protection Act 2018.
  3. Maintains trust between individuals, organisations and service providers.
  4. Reduces reputational damage and legal penalties for businesses.

Real‑World Illustration (AO2)

In 2023 the UK NHS suffered a breach where an employee’s lost laptop contained unencrypted patient records. The incident breached confidentiality and triggered a GDPR fine because the data were not protected by appropriate technical controls (encryption, access restrictions). The case highlights the importance of data minimisation, purpose limitation and secure disposal.

Core GDPR Principles (AO1‑AO2)

  • Lawfulness, fairness and transparency
  • Purpose limitation – personal data must be collected for specified, explicit and legitimate purposes.
  • Data minimisation – only the data necessary for the purpose should be collected and retained.
  • Accuracy
  • Storage limitation
  • Integrity and confidentiality (security) – Article 32 requires appropriate technical and organisational measures.
  • Accountability

Common Threats to Personal Data (AO2)

  • Malware – viruses, ransomware, spyware that can exfiltrate or encrypt data.
  • Phishing & Social Engineering – deceptive attempts to obtain credentials via email, SMS (smishing), voice (vishing) or fake websites (pharming).
  • Unauthorised Physical Access – loss or theft of devices containing personal data.
  • Insider Threats – employees or contractors misusing privileged access.
  • Insecure Networks – public Wi‑Fi or unencrypted connections that allow eavesdropping.

Data Classification Levels (AO1‑AO2)

Classification Description Typical Controls
Public Information intended for unrestricted public distribution. Minimal controls; may be posted on websites.
Internal Information for use within an organisation; not for public release. Access limited to staff; basic authentication.
Confidential Personal or sensitive data that could cause harm if disclosed. Strong authentication, encryption at rest & in transit, audit logs.
Secret / Highly Sensitive Data whose exposure would result in severe legal, financial or personal damage. Multi‑factor authentication, end‑to‑end encryption, strict access controls, regular penetration testing.

Technical Controls – Advantages & Disadvantages (AO2‑AO3)

Control How it works Advantages Disadvantages
Encryption (AES‑256, TLS 1.3) Transforms data into unreadable ciphertext; only the holder of the correct key can decrypt. Provides strong confidentiality for data at rest and in transit; satisfies GDPR Article 32. Key management can be complex; may add processing overhead on low‑power devices.
Strong Password Policies Require long, complex passwords and regular changes. Reduces risk of brute‑force attacks; easy to implement. Users may write passwords down or reuse them; frequent changes can lead to weaker choices.
Multi‑Factor Authentication (MFA) Combines something you know (password) with something you have (token, app) or are (biometrics). Provides an extra layer even if a password is compromised; resistant to phishing. Can inconvenience users; reliance on a secondary device that may be lost.
Firewalls (Network & Host) Filter traffic based on rule‑sets; block unauthorised connections. Effective first line of defence; can be centrally managed. Improper configuration can block legitimate traffic; does not stop insider threats.
Antivirus / Anti‑Malware Signature‑based and behavioural detection of malicious code. Detects known malware; often updates automatically. Zero‑day threats may evade detection; can cause performance slowdown.
Patch Management Regularly applying software updates to close vulnerabilities. Prevents exploitation of known flaws; improves overall system stability. Requires disciplined scheduling; occasional incompatibility issues.
Backup & Recovery (Encrypted, Off‑site) Regular copies of data stored securely away from the primary system. Mitigates data loss from ransomware, hardware failure or accidental deletion. Backup data itself can be targeted; restoration testing is time‑consuming.
Role‑Based Access Control (RBAC) & Least Privilege Assigns permissions based on job role; users receive only the access they need. Limits insider risk; simplifies permission audits. Complex organisations may find role design challenging; over‑restriction can hinder productivity.

Organisational & Legal Controls (AO2‑AO3)

  • Data Protection Legislation (GDPR, Data Protection Act 2018):
    • Lawful, fair and transparent processing.
    • Purpose limitation and data minimisation.
    • Security of processing (Article 32).
    • Notification of personal data breaches to the supervisory authority within 72 hours.
    • Rights of data subjects – access, rectification, erasure, restriction, portability.
  • Privacy Policies & Notices – clearly state what data is collected, why, how it is stored, and the rights of data subjects.
  • Data Protection Impact Assessments (DPIAs) – systematic process to identify and mitigate privacy risks before new projects or processing activities.
  • Staff Training & Awareness – regular sessions on phishing, secure handling of data, and incident reporting.
  • Incident Response Plan – defined steps for containment, investigation, notification, and remediation of data breaches.
  • Audit & Monitoring – log access, use Security Information and Event Management (SIEM) tools, and conduct periodic audits.
  • Secure Disposal – physical destruction or cryptographic erasure of media that is no longer required.

Malware – Types, Impacts and Prevention (5.2)

Types of Malware (required by the syllabus)

Type Typical Behaviour Real‑World Example
Trojan Disguises itself as legitimate software; creates back‑doors. Emotet banking Trojan (2020‑2022).
Worm Self‑replicates across networks without user interaction. WannaCry ransomware worm (2017).
Spyware Collects personal information covertly. FinSpy (FinFisher) targeting journalists.
Ad‑ware Displays unwanted advertisements and may redirect browsers. Fireball ad‑ware (2020).
Rootkit Hides its presence and that of other malware from detection tools. Stuxnet’s rootkit components (2010).
Ransomware Encrypts data and demands payment for the decryption key. Ryuk ransomware (2021).

Consequences of a Malware Infection (AO2)

  • Financial loss – ransom payments, remediation costs, legal fees.
  • Loss or corruption of personal data – breach of confidentiality and integrity.
  • Damage to reputation and loss of customer trust.
  • Operational downtime – reduced availability of services.

Prevention Methods – Advantages & Disadvantages (AO2‑AO3)

Method How it works Advantages Disadvantages
Antivirus / Anti‑Malware Software Signature and heuristic scanning of files and processes. Detects known threats; often updates automatically. May miss zero‑day malware; can affect system performance.
Application Whitelisting Only pre‑approved applications are allowed to execute. Prevents unauthorised code from running. Requires thorough inventory; legitimate new software may be blocked.
Sandboxing Runs suspicious programs in an isolated environment. Protects the host system from unknown behaviour. Resource‑intensive; some malware detects sandboxing and alters its behaviour.
Regular Patch Management Applies security updates to operating systems and applications. Closes known vulnerabilities exploited by malware. Requires disciplined scheduling; occasional compatibility issues.
Network Segmentation & Firewalls Separates networks into zones and controls traffic between them. Limits spread of malware across the organisation. Complex to design; mis‑configured rules can create blind spots.
User Education & Phishing Simulations Trains staff to recognise malicious links and attachments. Reduces the most common infection vector. Behaviour change is gradual; effectiveness varies between individuals.

Best Practices for Individuals (AO3)

  1. Use a unique, strong password for each online service; store them in a reputable password manager.
  2. Enable MFA wherever possible.
  3. Keep operating systems, browsers and applications up to date.
  4. Be cautious of unsolicited emails, SMS or calls asking for personal information (phishing, smishing, vishing).
  5. When using public Wi‑Fi, connect through a trusted VPN.
  6. Review and tighten privacy settings on social‑media and other platforms.
  7. Back up important personal files to an encrypted external drive or reputable cloud service.
  8. Lock devices with PIN, password or biometric lock when not in use.
  9. Dispose of old devices securely (data wiping or physical destruction).

Summary Checklist (AO1‑AO3)

  • Identify the personal data you hold or process.
  • Classify the data (Public, Internal, Confidential, Secret).
  • Apply appropriate technical controls – encryption, MFA, firewalls, antivirus, patch management.
  • Implement organisational policies – privacy notices, DPIAs, staff training, incident response, secure disposal.
  • Maintain regular, encrypted backups and test restoration procedures.
  • Monitor for threats (SIEM, logs) and respond promptly to incidents.
  • Review legal obligations (GDPR, Data Protection Act) and ensure breach‑notification procedures are in place.

Self‑Assessment Questions (AO1‑AO3)

  1. Explain the difference between confidentiality, integrity and availability (the CIA triad).
  2. List three technical controls that protect personal data in transit and discuss one advantage and one disadvantage of each.
  3. What legal obligations do organisations have under GDPR regarding personal data breaches?
  4. Describe how the principle of least privilege reduces insider risk.
  5. Why is multi‑factor authentication considered more secure than a password alone?
  6. Identify and briefly describe the six types of malware required by the syllabus.
  7. Compare two malware‑prevention methods, highlighting one advantage and one disadvantage of each.
Suggested diagram: “Flow of Personal Data Security Controls” – shows data creation → storage (encryption, access control) → transmission (TLS, VPN) → processing (RBAC, monitoring) → disposal (secure erasure). Icons indicate where technical, organisational and legal controls apply.

Create an account or Login to take a Quiz

35 views
0 improvement suggestions

Log in to suggest improvements to this note.