Core Concepts of Data Protection
What data protection is about
Data protection law governs how organisations may collect, use, share and keep information about identifiable people. The protected object is the personal data; the protected person is the data subject.
Key terms to know cold:
- Personal data: any information relating to an identified or identifiable natural person. Identifiability can be direct (a name) or indirect (an ID number, location data, an online identifier).
- Processing: almost anything done to data - collection, recording, storage, alteration, retrieval, consultation, disclosure, erasure. The trap is thinking processing means only using data.
- Controller vs processor: the controller decides why and how processing happens; the processor acts on the controller's instructions. A cloud vendor storing data for a company is usually a processor.
- Special categories: sensitive data (health, biometrics, ethnicity, religion, sexual orientation) needing extra safeguards.
Traps in questions
- Anonymised vs pseudonymised: pseudonymised data (a key still links it back) is still personal data; truly anonymised data is outside scope.
- Business vs personal data: a company email address identifying a person is personal data.
- Controller/processor confusion: whoever determines the purpose is the controller, even if another firm hosts the data.
Worked rule of thumb
Ask two questions: Does this relate to a living identifiable person? If no, data protection does not apply. If yes, who decides the purpose? That party is the controller and carries primary responsibility. Apply this to any scenario question and the roles usually fall out cleanly.