Community resourceWorksheet

J277 1.6.1 Personal data and data protection

Part 2 of 5 · J277 1.6 · Digital impacts: Essentials

Personal data and the purpose of the Data Protection Act 2018, applied at GCSE level.

Students will:

  • recognise personal data
  • explain responsible collection, use, accuracy, retention and security
  • apply data-protection responsibilities to stated situations
  • explain why security alone is insufficient
  • identify an appropriate action and its effect

Inside: 3 text sections, 3 multiple-choice activities, 1 completion activity, 6 written answers. 17 marks. Suggested teaching time: 40–60 minutes. 1 diagram.

Includes a teacher guide with suggested sections, timings and common misconceptions.

Series: J277 1.6 · Digital impacts: Essentials, part 2 of 5.

Shared by Coding PathwayVerified teacher

  • 13 cells
  • About 45 minutes
  • CC BY-SA 4.0
  • Shared 17 Aug 2026
  • Updated 27 Oct 2026

Preview

The whole resource, exactly as a class sees it. Answers and marking are held back.

Personal data and data protection

Personal data relates to an identifiable person. A name linked to attendance, an identifiable photograph or an account's location history can be personal data.

The Data Protection Act 2018, alongside the UK GDPR, sets rules for using personal data and protects people's rights. At GCSE, apply its purpose to the data in a situation; you do not need to memorise legal sections.

Multiple choice1 mark

Which item is personal data in this situation?

  • AA blank attendance form
  • BAn anonymous total with no way to identify visitors
  • CA student's name linked to their attendance record
  • DA list of classroom wall colours

1. Use data responsibly

ResponsibilityMeaning
Lawfulness, fairness and opennessHave a valid reason and tell people how data is used.
Purpose and minimisationUse data for appropriate stated purposes; collect only what is needed.
AccuracyCorrect inaccurate information.
RetentionKeep data no longer than needed.
SecurityProtect against inappropriate access, loss or changes.

People have rights to information about its use, access to their data and correction of inaccurate data, subject to the rules that apply. Consent is one possible lawful basis, not the only one. A lawful basis is a valid legal reason for using the data.

Consider data throughout its use Before collecting data, decide its purpose and what is needed. While using data, keep it accurate and protected. Review how long it is needed and remove it safely when it is no longer required. Before collectionClear purpose; only needed data During useKeep it accurate and protected Review retentionKeep it only as long as needed
Fill in the blanks3 marks
Data should be collected for a stated Answer 1, kept Answer 2 and retained only as long as Answer 3.
  • accurate
  • necessary
  • purpose
  • unlimited period
  • public
Written answer1 mark

State one purpose of the Data Protection Act 2018.

Students type their answer here.

Written answer2 marks

A school club app needs names and attendance dates. It also records students' locations all day, although the club does not need this information. Explain one data-protection concern.

Students type their answer here.

Written answer2 marks

A club tells members their contact details will be used only for club bookings. It then plans to pass them to advertisers without telling members. Explain one concern about this proposed use.

Students type their answer here.

Written answer2 marks

A club plans to keep every old attendance record forever without checking whether it is still needed. Recommend one improvement and explain its purpose.

Students type their answer here.

Multiple choice1 mark

An organisation holds a person's account history. Which action best reflects the person's data-access rights?

  • ARefuse every request because the organisation owns a computer
  • BProvide access to the person's data when required by the applicable rules
  • CPublish everybody's account histories on a website
  • DRequire the person to guess the account password of an employee
Written answer2 marks

A club keeps members' private contact details in an account every volunteer can open. Some volunteers have no need for the details. Recommend one security control and explain how it helps.

Students type their answer here.

Multiple choice1 mark

Which statement is accurate?

  • AConsent is the only possible lawful basis
  • BEncryption allows personal data to be kept forever for any purpose
  • COrganisations must never use personal data
  • DA valid lawful basis is needed, and other data-handling duties still apply
Written answer2 marks

A customer tells an organisation that the date of birth in their account is wrong. Explain one relevant data-protection responsibility.

Students type their answer here.

Review

Use the actual data and proposed action in each answer. Securing information and deciding whether it should be collected are different questions.