5.1 Data protection and privacy
Data protection is the set of practices, technologies and rules used to keep data safe from loss, misuse, damage and unauthorised access throughout its life, from collection to disposal. Privacy is the right of individuals to control information about themselves: to decide what is collected, who may see it and how it is used. The two are closely linked: data protection provides the means, and privacy is one of the main things it protects. Both matter more as organisations hold large amounts of personal data in digital systems. Example: a hospital protects patient records with access controls and backups (data protection) and allows only the treating clinicians to see a patient's diagnosis (privacy).
5.1.1 Data protection and privacy compared
| Feature |
Data protection |
Privacy |
| Meaning |
Safeguarding data from loss, misuse and unauthorised access |
An individual's right to control their personal information |
| Focus |
How data is secured and managed |
Who may collect, see and use personal information |
| Applies to |
All data, personal and organisational |
Mainly personal information |
| Main responsibility |
Organisations and system owners |
Organisations, with individuals exercising their rights |
| Example |
Encrypting a payroll database |
Not disclosing an employee's salary to other staff |
5.1.2 Types of data requiring protection
- Personal data: Information that identifies a person, such as name, ID number, phone number, email address and location.
- Sensitive personal data: Data that can cause serious harm if exposed, such as health records, biometric data, religious beliefs, ethnic origin and family details.
- Financial data: Bank account details, card numbers, mobile money records and salaries.
- Organisational data: Business plans, contracts, designs, tender documents and trade secrets.
- Operational data: System passwords, network diagrams and security settings.
- Public data: Information intended for the public, such as published price lists, which still needs protection from unauthorised changes.
5.1.3 Importance of data protection and privacy
- Respecting human rights: Privacy is a constitutional right in Kenya under Article 31.
- Preventing harm to individuals: Protects people from identity theft, fraud, discrimination and embarrassment.
- Building trust: Customers, patients and students trust organisations that handle their data carefully.
- Legal compliance: Organisations avoid fines and lawsuits by meeting legal requirements.
- Protecting business value: Prevents loss of trade secrets and competitive information.
- Business continuity: Protected data can be recovered after incidents, keeping services running.
5.1.4 Threats to privacy
- Excessive data collection: Organisations collecting more information than they need.
- Online tracking: Websites, apps and advertisers following users' activity across the internet.
- Profiling: Combining data to build detailed pictures of people's habits, beliefs and finances.
- Oversharing: Users posting personal details, locations and photos publicly on social media.
- Unauthorised sharing: Staff or organisations passing data to third parties without permission.
- Data leaks: Accidental exposure, such as sending a file to the wrong email address or leaving records unprotected online.
- Surveillance: Monitoring through cameras, phones and online services without proper justification.
5.1.5 Protecting data through its life cycle
Data needs protection at every stage of its life. Example: a microfinance bank protects a loan applicant's details from the moment the form is filled until the records are destroyed after the retention period.
| Stage |
Protection measures |
| Collection |
Collect only necessary data, inform people of the purpose, obtain consent |
| Storage |
Store in secure systems with access control, encryption and backups |
| Use |
Allow access only to authorised staff for the stated purpose |
| Sharing |
Share only with authorised parties under agreements, using secure channels |
| Archiving |
Move old records to secure archives with restricted access |
| Disposal |
Securely delete digital data and shred paper records when no longer needed |
Worked example: record retention and disposal
A hotel keeps guest registration records for 5 years after the year of the stay and then disposes of them. Find the year in which records from 2021 are due for disposal.
Disposal year = year of stay + retention period + 1
Disposal year = 2021 + 5 + 1
Answer: records from 2021 are kept to the end of 2026 and securely disposed of in 2027
5.1.6 Data classification
Data classification is grouping data according to how sensitive it is, so that the right level of protection is applied to each group.
| Class |
Description |
Example |
| Public |
May be shared freely |
Published brochures and price lists |
| Internal |
For staff use only |
Staff circulars and internal procedures |
| Confidential |
Limited to authorised staff; harm if disclosed |
Customer records, contracts |
| Restricted (highly confidential) |
Strictly limited; serious harm if disclosed |
Medical records, passwords, payroll |
5.1.7 Good privacy practices
Practices for organisations
- Privacy by design: Build privacy protection into systems and processes from the start.
- Privacy notices: Tell people clearly what data is collected and why.
- Need-to-know access: Give staff access only to the data their work requires.
- Staff training: Train staff to handle personal data correctly.
- Clean desk and screen policy: Lock screens and keep documents out of sight when away.
- Secure disposal: Shred paper and wipe storage devices before disposal.
Practices for individuals
- Share minimum information: Give only the details genuinely required.
- Adjust privacy settings: Limit who can see posts, contacts and location.
- Review app permissions: Deny access to contacts, camera or location when not needed.
- Be careful on public devices: Log out and avoid saving passwords on shared computers.
- Check who is asking: Confirm the identity of anyone requesting personal details.
The rest of this chapter
🔒Create a free account to open more of this chapter.
Free: practical guides, quick cards, workplace scenarios and more.
Create a free account 🔒5.2 Confidentiality of data/information
Confidentiality is the principle that data and information should be available only to people, systems and processes that are authorised to see it. It is one of the three core goals of information security, together with integrity (5.3) and availability (5.4),…
🔒5.3 Integrity of data/information
Integrity is the principle that data and information must remain accurate, complete, consistent and trustworthy throughout their life, and must not be changed except by authorised people through authorised processes. Data that has lost its integrity may look n…
🔒5.4 Availability of data/information
Availability is the principle that data, information and systems must be accessible and usable by authorised users whenever they need them. Even data that is perfectly confidential and accurate is of little value if it cannot be reached when a decision or serv…
🔒5.5 Internet security threats
An internet security threat is any possible danger that can exploit a weakness in a computer, network, device or user over the internet to steal, alter, destroy or block access to data and systems. Threats come from cybercriminals, hackers, dishonest insiders…
🔒5.6 Computer threats and crimes
A computer threat is anything that can cause loss, damage, disruption or unauthorised access to computer systems and the data they hold, whether it comes from nature, accidents, equipment failure or people acting deliberately. A computer crime (cybercrime) is…
🔒5.7 Cybersecurity control measures
Cybersecurity control measures (security controls) are the safeguards an organisation puts in place to prevent, detect and respond to threats against its computers, networks and data. No single control is enough, so organisations use layers of protection, ofte…
🔒5.8 Laws governing protection of ICT in Kenya
Kenya protects computer systems, data and the people who use them through a set of laws that define cyber offences, set penalties, protect privacy and create institutions to enforce these rules. The two main laws are the Computer Misuse and Cybercrimes Act, 20…
