5.1 Data protection and privacy

Data protection is the set of practices, policies and technical measures used to safeguard personal and organisational data from misuse, loss, theft and unauthorised access throughout its life, from collection to disposal. Privacy is the right of individuals to control information about themselves: what is collected, who can see it, how it is used and with whom it is shared. The two are closely linked: data protection is the means, and privacy is the right being protected. As more services go digital, from mobile money to hospital records, organisations hold large amounts of personal data, so protecting it builds trust and avoids harm such as fraud, discrimination and embarrassment. Example: a pharmacy chain that keeps customers' prescription histories limits access to pharmacists only, stores the records in an encrypted system and never shares them with advertisers.

5.1.1 Data protection and privacy compared

Data protection and privacy are often used interchangeably, but they focus on different things. Understanding the difference helps organisations know both what they must protect and why. Example: a payroll office protects salary files with passwords and backups (data protection) and also ensures staff salaries are not revealed to other employees (privacy).

5.1.2 Types of data that need protection

Different types of data carry different levels of risk if exposed, so they need different levels of protection. Classifying data helps organisations apply stronger safeguards where the harm would be greatest. Example: a university treats student contact lists as personal data but places medical and disability records in a restricted category with tighter controls.

Categories of data

• Personal data: Information that identifies a person directly or indirectly, such as name, ID number, phone number, email address, photo or location.
• Sensitive personal data: Data that could cause serious harm if exposed, such as health records, biometric data, ethnicity, religion, sexual orientation and financial details.
• Children's data: Information about minors, which needs extra care and parental consent in many situations.
• Financial data: Bank account details, card numbers, mobile money records and credit history.
• Organisational confidential data: Business plans, contracts, trade secrets and internal reports.
• Public data: Information already intended for public release, such as published annual reports.

5.1.3 Privacy risks in the digital world

Everyday digital activities leave traces that can be collected, combined and used in ways people do not expect. Being aware of these risks helps individuals and organisations protect privacy. Example: a customer who joins many loyalty programmes later receives targeted marketing calls because her phone number was shared with third parties without her clear consent.

Common privacy risks

• Excessive data collection: Apps and forms ask for more information than they need.
• Online tracking: Cookies, trackers and device identifiers follow users across websites.
• Profiling: Data is combined to predict a person's behaviour, income or preferences.
• Data sharing and selling: Personal data is passed to third parties without the person's knowledge.
• Location tracking: Phones and apps record where people go.
• Data leaks and breaches: Personal data is exposed through hacking or careless handling.
• Surveillance: Monitoring of communications and movements beyond what is necessary.
• Oversharing on social media: People reveal personal details that can be misused.

5.1.4 Data protection practices for organisations

Organisations that collect personal data must handle it responsibly at every stage, from collection to deletion. Building privacy into systems and processes from the start, known as privacy by design, prevents problems rather than reacting after harm occurs. Example: a microfinance institution designing a new loan app asks only for the details needed to assess loans, explains how data is used and sets automatic deletion of rejected applications after a set period.

Practices for protecting data

• Privacy by design and by default: Build privacy protections into systems, with the most private settings as the default.
• Data minimisation: Collect only the data needed for a clear purpose.
• Clear privacy notices: Tell people what data is collected, why, how long it is kept and who it is shared with.
• Consent management: Obtain, record and respect people's consent and allow them to withdraw it.
• Access on a need-to-know basis: Allow only staff who need the data to access it.
• Anonymisation and pseudonymisation: Remove or replace identifying details when full identity is not needed, for example in research or reports.
• Retention schedules: Keep data only as long as necessary, then delete it securely.
• Data protection impact assessment (DPIA): Assess privacy risks before starting new projects that process large amounts of personal data.
• Staff training: Train employees to handle personal data correctly.

Steps in managing personal data through its lifecycle

1. Collection: Collect only necessary data, with a clear purpose and consent where required.
2. Storage: Store data in secure, access-controlled systems.
3. Use: Use data only for the stated purpose.
4. Sharing: Share only with authorised parties and under agreements that protect the data.
5. Retention: Keep data for the defined period in the retention schedule.
6. Archiving: Move inactive records to secure archives where needed.
7. Disposal: Securely delete digital data and shred paper records when no longer needed.

5.1.5 Protecting personal privacy as an individual

Individuals also play a major role in protecting their own privacy by controlling what they share and how their devices and accounts are set up. Example: a teacher reviews the permissions on her phone and finds that a torch app had access to her contacts and location, so she removes it.

Personal privacy practices

• Share less personal information: Avoid posting ID numbers, addresses and daily routines online.
• Review privacy settings: Adjust settings on social media, apps and browsers.
• Read privacy notices: Understand how services will use your data before signing up.
• Limit app permissions: Allow only the access an app genuinely needs.
• Use private browsing and tracker blockers: Reduce online tracking.
• Exercise your rights: Ask organisations what data they hold about you and request corrections or deletion where appropriate.
• Shred documents: Destroy paper documents containing personal details before disposal.

Worked example: records due for deletion under a retention schedule

Records to delete = total records − records still within the retention period

A clinic's retention schedule keeps appointment records for 5 years. It holds 48,000 records, of which 36,500 are less than 5 years old.

Records to delete = 48,000 − 36,500

Records to delete = 11,500 records

Percentage to delete = 11,500 ÷ 48,000 × 100 ≈ 24%