Law, Data Protection and Responsibility

For this October 2026 review, the UK GDPR and Data Protection Act 2018 remain central to personal-data protection. The Data (Use and Access) Act 2025 amends this framework rather than replacing it. Detailed provisions and guidance can change, so verify current official guidance for a specific real-world decision.

Core principles include lawful, fair and transparent processing; purpose limitation; minimisation; accuracy; storage limitation; security; and accountability. Apply them concretely: collecting location data indefinitely “just in case” needs a different justification from collecting the minimum needed for a defined service. Consent is not the only possible lawful basis.

The Computer Misuse Act addresses offences involving unauthorised computer access and related acts. Having technical ability to enter a system does not establish permission. A classroom or testing exercise should use explicit authorisation and the scope agreed by the owner.

Copyright concerns protected expression such as software code and images; being publicly viewable online does not automatically grant permission to copy or redistribute. A licence can grant specific rights subject to conditions. Attribution alone does not necessarily supply a missing licence, and a software licence does not automatically authorise access to someone else’s system.

Legislators face cross-border services, changing technology, enforcement costs and competing interests such as privacy, security and expression. Rules must also be understandable enough for organisations and individuals to apply. Avoid assuming one country’s rule automatically applies unchanged everywhere.

For an examination response, explain the relevant issue, affected information or right, and a feasible action such as minimising collection or respecting a licence. AQA’s consequences section emphasises contextual discussion, not merely memorising historic legislation names. For practical projects, follow the centre’s current requirements and consult authoritative sources rather than treating revision notes as an individual legal determination.

Attempt the task before opening its worked response. Record each change of state, explain the rule used, and check the result against the original requirements. Code examples labelled Python 3 use that language’s conventions; pseudocode states its own assumptions.