Week 10

Question 1

What law governs data protection in the UK after Brexit?

Answer 1

UK GDPR and Data Protection Act (DPA) 2018.

Question 2

Who is a Data Controller?

Answer 2

The person or organization that decides how and why personal data is used.

Question 3

Who is a Data Processor?

Answer 3

A person or company that processes data on behalf of the controller.

Question 4

Name the 7 principles of UK GDPR (Article 5).

Answer 4

Lawfulness, fairness, transparency
Purpose limitation
Data minimisation
Accuracy
Storage limitation
Integrity and confidentiality
Accountability

Question 5

What are the 6 lawful bases for processing personal data (Article 6)?

Answer 5

Consent
Contract
Legal obligation
Vital interests
Public task
Legitimate interests

Question 6

What is Special Category Data?

Answer 6

Sensitive data like health, race, religion, sexual orientation — needs stronger protection.

Question 7

Name five rights of a data subject under UK GDPR.

Answer 7

Any of:

1. Right to be informed – Know how their data is used.
2. Right of access – See their data.
3. Right to rectification – Fix incorrect data.
4. Right to erasure – “Right to be forgotten.”
5. Right to restrict processing – Limit how it’s used.
6. Right to data portability – Transfer data to another service.
7. Right to object – Say no to data use in some cases.
8. Rights in automated decision-making – Protection from decisions made solely by computers.

Question 8

What is a Data Protection Impact Assessment (DPIA)?

Answer 8

A process to identify and reduce data protection risks in new projects.

Question 9

When is a DPIA required?

Answer 9

You need a DPIA when your project might put people’s privacy at high risk. This includes:

When using new tech
Tracking people
Watching people regularly
Handling sensitive data on a large scale e.g. health

Question 10

What are the key steps in a DPIA?

Answer 10

Describe the processing
Assess the necessity and proportionality
Identify and assess risks
Define ways to reduce those risks

Question 11

Why is DPIA important?

Answer 11

It helps organizations comply with the law, protect people’s privacy, and avoid fines.

Question 12

What can happen if a company doesn’t comply with GDPR?

Answer 12

Heavy fines (up to £17.5 million or 4% of global turnover), legal action, reputational damage.