5. Technical Safeguards – Protecting Data (Section 8.3 – Security of Data – Protection Measures)
Access controls & passwords – role‑based permissions and strong password policies to limit who can view or edit data.
Two‑factor authentication (2FA) – a second code sent to a mobile device adds an extra layer of security.
Biometric verification – fingerprint or facial recognition for high‑security areas.
Encryption – AES for data at rest; TLS/SSL for data in transit, ensuring integrity and confidentiality.
Digital certificates & PKI – verify the identity of websites and email senders.
Firewalls & intrusion‑detection systems – filter unwanted traffic and alert on suspicious activity.
Secure sockets (HTTPS, SFTP) – safe file transfer and web browsing.
Regular software updates & patches – close known security holes.
Backup & recovery – automated daily backups stored off‑site; data are retained only for the period defined in the school’s retention schedule and securely deleted thereafter.
Anti‑malware and ransomware protection – real‑time scanning and behavioural analysis.
Linking safeguards to the seven principles:
Access controls, passwords and role‑based permissions support Lawful, Fair and Transparent Processing and Accountability.
Encryption, firewalls and secure sockets directly address Integrity and Confidentiality (Security).
Backup & recovery together with the retention schedule fulfil Storage Limitation and aid Accountability.
Regular updates and anti‑malware tools help maintain Integrity and Confidentiality by preventing unauthorised alteration.
Biometric verification and 2FA reinforce Integrity and Confidentiality while also demonstrating Accountability through robust access control.
6. Seven Core Principles of a Data‑Protection Act
Principle
Explanation
Lawful, Fair and Transparent Processing
Data must be processed legally, respect individuals’ rights and be clear about how it is used.
Purpose Limitation
Collect data only for specified, explicit and legitimate purposes; do not reuse incompatibly.
Data Minimisation
Gather only the data necessary for the intended purpose.
Accuracy
Keep data accurate and up‑to‑date; correct or delete errors promptly.
Storage Limitation
Retain data no longer than needed for its original purpose.
Integrity and Confidentiality (Security)
Protect data with appropriate technical and organisational measures against unauthorised access, loss or damage.
Accountability
The data controller must demonstrate compliance with all other principles.
6.1 School‑Level Examples for Each Principle
Lawful, fair & transparent: Provide a privacy notice on the school portal explaining why student names and grades are stored.
Purpose limitation: Collect pupil emergency‑contact details only for safeguarding; do not use them for marketing.
Data minimisation: Record only the pupil’s roll number and class, not their home address, unless required for a specific activity.
Accuracy: Update the pupil’s medical information each term and delete outdated allergy notes.
Storage limitation: Delete exam papers and associated personal data after the statutory retention period (e.g., 5 years).
Integrity & confidentiality: Store staff payroll files on an encrypted server and restrict access to HR personnel.
Accountability: The headteacher signs off the school’s data‑protection policy and can produce evidence of staff training.
7. Applying the Principles in Practice
Conduct a Data Audit – list what personal data is held, where it is stored and who can access it.
Produce a clear Privacy Notice for pupils, parents and staff.
Implement Access Controls – role‑based passwords, lock screens, and 2FA for admin accounts.
Use Encryption for files containing personal data and for data transmitted over the internet.
Set up a Retention Schedule and securely delete data once it is no longer needed.
Provide regular Data‑Protection Training for teachers, support staff and senior students.
Appoint a Data Protection Officer (DPO) (or designate a senior staff member) to oversee compliance and act as the point of contact for data‑subject requests.
Maintain a Record of Processing Activities (ROPA) – a log of what data is processed, why, and how it is protected.
Establish a Data‑Breach Response Plan – steps to contain, assess, report (to the ICO within 72 hours) and communicate any breach.
8. Legal and Organisational Responsibilities
Data Protection Officer (DPO) – monitors compliance, advises on impact assessments, and liaises with the Information Commissioner’s Office (ICO).
Accountability – senior management must ensure policies are in place and that staff can demonstrate compliance.
Data‑subject rights – right to access, rectify, erase, restrict processing, data portability and to object.
Impact assessments – required for high‑risk processing (e.g., new student‑tracking system).
Reporting breaches – notify the ICO and affected individuals when a breach is likely to result in risk to individuals’ rights.
9. Consequences of Non‑Compliance
Financial penalties – up to £17.5 million or 4 % of global turnover under GDPR.
Legal action from affected individuals (compensation claims).
Reputational damage and loss of confidence from pupils, parents and partners.
Enforcement orders – e.g., mandatory cessation of processing, forced data deletion, or audit requirements.
10. Suggested Diagram
Flowchart of the data lifecycle – Collection → Storage → Use → Sharing → Retention → Disposal – with a checkpoint for each of the seven data‑protection principles.
11. Summary Checklist for Students (Command‑Word Style)
Explain why protecting personal data is essential for individuals and organisations.
Recall the seven core principles of a data‑protection act and give a school‑level example for each.
Identify at least eight common ICT threats (phishing, pharming, smishing, vishing, malware, ransomware, card‑fraud, shoulder surfing, hacking) and the appropriate preventive measures.
List technical safeguards (access controls, 2FA, biometrics, encryption, digital certificates, firewalls, secure sockets, updates, backup & recovery, anti‑malware) and describe when they are used.
State the possible penalties for breaching data‑protection legislation.
Describe the role of a Data Protection Officer and why accountability matters.
Apply the e‑Safety checklist when using the internet, email and social media.