Privacy and Personal Data Protection

Introduction and Context

Privacy and personal data protection are central concerns in cyber law because modern organisations collect, analyse, share and retain information about identifiable people. Personal data supports banking, healthcare, education, employment, government services, digital marketing and artificial intelligence. The same data can, however, enable identity theft, discrimination, surveillance, manipulation and serious personal harm.

Privacy is a broader social, ethical and legal interest in personal autonomy, dignity, confidentiality and control over information. Data protection is the legal and organisational framework governing the collection and use of information relating to individuals. Privacy is therefore not simply secrecy. A person may knowingly disclose information to a hospital or online service while still expecting it to be used fairly, securely and only for legitimate purposes.

This chapter uses internationally recognisable principles, with the European Union General Data Protection Regulation (GDPR) as a major reference point. Other regimes—including the United Kingdom GDPR, Brazil’s LGPD, India’s Digital Personal Data Protection Act, Singapore’s PDPA and state privacy laws in the United States—use different terminology and obligations. Organisations must identify the law applicable to the person, activity, location and transaction concerned. This chapter is educational and does not replace jurisdiction-specific legal advice.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Distinguish personal data, sensitive data, processing, controllers and processors.
2. Apply lawful-processing, fairness, transparency, purpose-limitation and data-minimisation principles.
3. Explain consent and other lawful bases for processing.
4. Recognise individual rights and design a process for responding to requests.
5. Apply retention, security and breach-notification requirements across the data lifecycle.
6. Explain when a data protection impact assessment (DPIA) and a data protection officer may be required.
7. Identify the principal issues in cross-border data transfers.
8. Evaluate an organisational data practice from legal, ethical and operational perspectives.

1. The Data Protection Vocabulary

Personal data

Personal data is information relating to an identified or identifiable living individual. Direct identifiers include a name, identity number, email address or photograph. Indirect identifiers may include an IP address, device identifier, location pattern, employment role or combination of apparently harmless attributes. A dataset can therefore be personal data even when names have been removed if individuals can reasonably be re-identified.

Pseudonymisation replaces direct identifiers with codes while keeping a means of linking the record to the individual. Pseudonymised data generally remains personal data because re-identification is possible. Anonymisation aims to make identification irreversible using reasonably available means. Anonymisation is a demanding standard; simply deleting names is not necessarily sufficient.

Special or sensitive categories

Many legal systems give enhanced protection to information such as health, genetic and biometric data used for uniquely identifying a person, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership and sexual orientation. Criminal-record information and information about children may also receive special protection. Processing such information often requires both a general lawful basis and an additional statutory condition.

Processing

Processing includes almost any operation performed on personal data: collecting, recording, organising, storing, retrieving, consulting, analysing, disclosing, transferring, combining, restricting, deleting and destroying it. Consequently, privacy obligations apply throughout the information lifecycle rather than only at the point of collection.

Roles and accountability

A controller (or equivalent term in some laws) determines why and how personal data is processed. A processor acts on the controller’s documented instructions. A cloud provider may be a processor for hosting customer records, but it may become a controller for its own independent purposes, such as managing billing or preventing fraud. Two or more organisations may be joint controllers where they jointly determine purposes and essential means.

Contracts should clearly define instructions, confidentiality, security, sub-processors, assistance with individual rights, breach support, deletion or return of data and audit arrangements. A contract alone does not remove the controller’s accountability.

2. The Core Principles of Lawful Processing

The principles provide a decision framework for every processing activity. Under GDPR-style regimes, organisations must be able to demonstrate compliance, not merely assert it.

Lawfulness, fairness and transparency

Processing must have a recognised legal basis, must not be deceptive or unfair, and must be explained in accessible language. A privacy notice should normally identify the organisation, categories and sources of data, purposes, legal bases, recipients, retention periods, rights, complaint routes and relevant transfers. Information should be provided when it is useful to the individual, not hidden in an unreadable document.

Fairness requires attention to power imbalance, unexpected uses, discriminatory effects and the reasonable expectations of individuals. A technically legal activity may still be unfair if it exploits vulnerability or produces unjustified consequences.

Purpose limitation

Data should be collected for specified, explicit and legitimate purposes and not subsequently used in a manner incompatible with those purposes. “Improving services” may be too vague by itself. A precise purpose might be “to verify a customer’s identity for opening and maintaining a regulated account.”

Further use should be assessed by considering the relationship with the individual, the context of collection, the nature of the data, possible consequences and safeguards such as separation or pseudonymisation. A new purpose may require a new notice, consent or another legal basis.

Data minimisation

Only data that is adequate, relevant and limited to what is necessary should be collected. Minimisation concerns fields, precision, frequency, access and retention. For example, a delivery service may need a delivery address but not a customer’s full medical history. Collecting information “in case it may be useful” creates legal, security and ethical exposure.

Accuracy

Reasonable steps should be taken to keep personal data accurate and up to date. Individuals should be able to correct inaccurate information, especially where it affects credit, employment, benefits, healthcare or access decisions.

Storage limitation

Personal data should not be retained in identifiable form longer than necessary for the purpose, subject to legal, regulatory, accounting, litigation or archival requirements. Retention schedules should specify categories, triggers, periods, owners and secure deletion methods. Backup copies, test environments, email archives and paper records must also be addressed.

Integrity, confidentiality and accountability

Appropriate technical and organisational measures must protect data against unauthorised or unlawful processing, accidental loss, destruction and damage. Accountability requires evidence: policies, records of processing, contracts, risk assessments, training, access logs, testing and management decisions.

3. Lawful Bases and Consent

A processing activity should be mapped to a lawful basis before collection begins. Under GDPR, common bases are:

The legal basis must reflect the real purpose. An organisation should not select consent simply because it appears easy, nor use a contract as a device to make optional advertising appear compulsory.

Consent in practice

Valid consent is a genuine choice. It should be distinguishable from unrelated terms, expressed through clear affirmative action and recorded with the wording, date, method and scope. Pre-ticked boxes, silence and inactivity generally do not demonstrate consent under GDPR-style rules. Consent should be as easy to withdraw as to give. Withdrawal does not normally invalidate processing that was lawful before withdrawal, but future processing must stop unless another lawful basis applies and has been properly established.

Children’s consent may require parental authorisation, depending on the service and jurisdiction. Consent is also problematic where there is a substantial power imbalance, such as between employer and employee.

4. Individual Rights

Rights support autonomy and make data protection enforceable. The precise scope and exemptions vary by law.

• Right to information: Individuals should receive clear privacy information.
• Right of access: They may request confirmation of processing and a copy of relevant personal data, together with contextual information such as purposes and recipients.
• Right to rectification: Inaccurate or incomplete data should be corrected.
• Right to erasure: Data may need to be deleted where it is no longer necessary, consent is withdrawn and no alternative basis exists, or processing is unlawful. This right is not absolute; legal obligations, freedom of expression, public interest and litigation may justify retention.
• Right to restriction: Processing may be paused while accuracy or lawfulness is contested.
• Right to data portability: In qualifying circumstances, information provided by an individual and processed by automated means on the basis of consent or contract may be supplied in a structured, commonly used and machine-readable format.
• Right to object: Individuals may object to processing based on legitimate interests or public tasks and have an especially strong right to object to direct marketing.
• Rights concerning automated decision-making: Certain solely automated decisions producing legal or similarly significant effects may be restricted and may require safeguards such as human intervention, an opportunity to express a view and contest the decision.

Organisations should establish an identity-verification method proportionate to the risk. They should search relevant systems, preserve audit trails, respond within applicable statutory periods and explain any refusal. Staff must avoid disclosing one person’s data while fulfilling another person’s request.

5. Security Across the Data Lifecycle

Privacy compliance depends on security, but security alone does not make processing lawful. A secure database used for an unjustified purpose remains unlawful.

A risk-based security programme commonly includes:

• data inventory and classification;
• least-privilege access and strong authentication;
• encryption in transit and at rest where appropriate;
• secure development, patching and vulnerability management;
• network segmentation and endpoint protection;
• logging, monitoring and alerting;
• tested backups and recovery procedures;
• staff training, confidentiality duties and anti-phishing controls;
• supplier assurance and incident-response exercises; and
• secure disposal of devices, media and paper.

Controls should be proportionate to the likelihood and severity of harm, taking account of the state of technology, implementation cost, processing context and organisational resources. Access should be reviewed when roles change, and privileged actions should be monitored. Privacy by design and by default means incorporating minimisation, limited visibility, protective settings and user control at the design stage rather than adding them after deployment.

6. Personal Data Breaches

A personal data breach is a security incident involving accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to personal data. Examples include a stolen laptop, ransomware, a misdirected email, an exposed cloud bucket and an employee viewing records without authorisation.

An incident-response process should:

1. contain the incident and preserve evidence;
2. establish what data, systems and people are affected;
3. assess likelihood and severity of harm;
4. notify the regulator where required within the applicable period;
5. communicate with affected individuals where the risk is high or law requires it;
6. document decisions, even where notification is not made; and
7. remediate the cause and test improvements.

Under the GDPR, a controller generally notifies the supervisory authority within 72 hours of becoming aware of a notifiable breach, unless the breach is unlikely to result in a risk to individuals. A processor should notify the controller without undue delay. High-risk breaches may require communication to affected individuals without undue delay. Other jurisdictions use different thresholds and deadlines, so the applicable law must be checked.

Notification should be accurate and useful: explain what happened, the data involved, likely consequences, protective steps and contact channels. Concealing uncertainty or making unsupported assurances can increase harm and liability.

7. Retention, Records and Governance

A retention schedule connects purposes to deletion. For each category, it should identify the business purpose, lawful basis, system owner, retention trigger, retention period, legal hold procedure, archival status and destruction method. A retention period may begin when an account closes, a contract ends, a claim is resolved or a statutory period expires.

Data should not be retained indefinitely merely because storage is inexpensive. Conversely, deletion should not destroy evidence subject to a lawful litigation hold or regulatory requirement. Deletion from an active system may need to be coordinated with backups and replicas, while recognising that immediate physical erasure of every backup may not always be technically feasible. Access should be blocked and data deleted during the next secure cycle where law permits.

Records of processing activities help an organisation understand what it does, why it does it, where data flows and which safeguards apply. Governance should assign responsibility to senior management, privacy professionals, security teams, procurement, legal advisers and system owners. Training should be role-specific rather than limited to an annual acknowledgement.

8. Data Protection Impact Assessments

A DPIA is a structured assessment used when processing is likely to result in a high risk to individuals. Examples may include large-scale sensitive-data processing, systematic monitoring of public areas, behavioural profiling, biometric identification or novel technologies with significant effects.

A useful DPIA contains:

1. a description of processing, purposes, data subjects, data flows and retention;
2. an assessment of necessity and proportionality;
3. an analysis of risks to rights and freedoms, including discrimination, loss of confidentiality, financial harm and loss of autonomy;
4. safeguards that reduce those risks;
5. residual-risk evaluation and approval; and
6. consultation with relevant stakeholders, including a regulator where required.

A DPIA is not a one-time form. It should be revisited when purposes, technology, suppliers, scale or risk changes. It should involve affected communities where practicable and should record assumptions rather than hide uncertainty.

9. Cross-Border Transfers

A transfer may occur when data is sent to another country, made accessible remotely from another country, or disclosed to an overseas supplier. Organisations must consider both the destination’s legal protections and the practical ability to enforce rights.

Common GDPR mechanisms include an adequacy decision, standard contractual clauses, binding corporate rules, approved codes or certification mechanisms, and limited derogations for exceptional situations. Contractual safeguards may need a transfer impact assessment addressing government-access laws, surveillance powers, redress, onward transfers and supplementary technical measures. Encryption, pseudonymisation, strict access controls and regional hosting can reduce risk, but technical measures cannot automatically cure every legal deficiency.

A transfer map should identify origin, destination, exporter, importer, purpose, data categories, processor chain, legal mechanism and deletion arrangements. Organisations should not assume that using an international cloud provider is legally neutral merely because servers are located locally; remote administrative access and corporate control may still create transfer issues.

10. Artificial Intelligence and Emerging Uses

AI systems intensify familiar data-protection problems. Training data may contain personal or sensitive information; models may memorise or infer attributes; outputs may be inaccurate; and automated decisions may produce discriminatory effects. Organisations should document data provenance, assess necessity, establish lawful purposes, test data quality, restrict sensitive inputs, provide human oversight and create mechanisms for correction or challenge.

A publicly available dataset is not automatically free of privacy obligations. De-identification must be tested against re-identification risks, linkage attacks and the model’s ability to reproduce information. Privacy-enhancing approaches—including aggregation, access controls, differential privacy and federated processing—can reduce exposure but involve trade-offs in accuracy, utility and complexity. Governance should also address vendor terms, model retention, prompt logging and secondary use.

Illustrative Case: HealthPlus Appointment Platform

Background

HealthPlus, a fictional private clinic network, launches an online appointment platform. It collects names, contact details, symptoms, insurance information, appointment history and device identifiers. A software supplier hosts the platform in one country, while a support team in another country can access production data.

Problem

The marketing department proposes using symptom descriptions and appointment history to target patients with wellness advertisements. The platform also retains all records indefinitely, uses a shared administrator account and has no documented breach procedure. A patient requests deletion after cancelling an appointment.

Analysis

The symptom information is sensitive health data. Providing medical appointments is a specific purpose distinct from targeted advertising. Marketing based on health information would require careful analysis of lawful basis, special-category conditions, fairness, transparency and likely prohibition or restriction under applicable law. Consent for optional marketing would need to be separate and freely withdrawable; preconditioned consent would be problematic.

Indefinite retention conflicts with storage limitation unless a documented legal or clinical requirement justifies it. The shared administrator account violates accountability and makes investigation difficult. Overseas support access is a cross-border transfer requiring a lawful mechanism and risk assessment. The scale and sensitivity of processing make a DPIA appropriate.

Approach and solution

HealthPlus should create a data inventory and purpose-specific privacy notice; separate appointment processing from optional marketing; collect only necessary information; establish a clinical and legal retention schedule; implement individual accounts, least privilege, multifactor authentication and access logging; revise the supplier agreement; conduct a DPIA and transfer assessment; and establish an incident-response and rights-request procedure. The deletion request should be assessed against clinical-record retention duties. Data no longer required for the appointment service should be securely deleted or anonymised, while legally required records should be retained with a clear explanation to the patient.

Outcome and learning points

The case demonstrates that privacy compliance is a lifecycle discipline. Lawful processing, minimisation, retention, security, rights management, supplier oversight and international transfers must be designed together. A privacy notice issued after launch cannot repair unjustified collection or weak governance.

Challenges and Limitations

Privacy laws may conflict across jurisdictions, and definitions of personal data differ. De-identification is vulnerable to new datasets and analytical techniques. Small organisations may lack specialist staff, while large organisations may create excessive bureaucracy. Consent banners can encourage formal compliance without meaningful understanding. Security controls can also conflict with accessibility or operational needs. Finally, risk cannot always be quantified precisely: legal compliance requires reasoned judgment, documentation and continuing review rather than a single numerical score.

The appropriate response is proportional governance. Organisations should prioritise high-risk processing, involve technical and operational teams, consult affected people, test controls and review decisions as technology and law change.

Chapter Summary

Personal data protection regulates information throughout its lifecycle, from collection and use to sharing, retention and deletion. Core principles require lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, security and accountability. Consent is only one lawful basis and must represent a genuine, informed and withdrawable choice. Individuals may exercise rights including access, correction, erasure, restriction, portability and objection, subject to legal exceptions.

Effective compliance combines privacy governance with information security, supplier management, retention schedules, breach response and documented decision-making. High-risk processing may require a DPIA, and international transfers require an appropriate legal mechanism and risk analysis. AI increases the importance of provenance, minimisation, human oversight and protection against inference and discrimination. The central professional lesson is that privacy is not a document or a single technical control; it is a continuing system of lawful purposes, responsible design and accountable practice.

Key Terms

Personal data: Information relating to an identified or identifiable living individual.

Sensitive data: Personal information receiving enhanced legal protection, such as health or biometric information.

Processing: Any operation performed on personal data, including collection, storage, use or deletion.

Controller: The organisation determining the purposes and essential means of processing.

Processor: An organisation processing data on behalf of a controller.

Pseudonymisation: Replacing identifiers with codes while retaining a method of re-linking data.

Anonymisation: Processing intended to make identification irreversible using reasonably available means.

Lawful basis: A recognised legal justification for processing personal data.

Consent: A freely given, specific, informed and unambiguous indication of an individual’s wishes.

Purpose limitation: Using data only for specified, explicit and legitimate purposes.

Data minimisation: Limiting data to what is adequate, relevant and necessary.

Storage limitation: Not retaining identifiable data longer than necessary.

Accountability: The duty to comply and demonstrate compliance.

Data subject: The individual to whom personal data relates.

Personal data breach: A security incident involving loss, destruction, alteration, disclosure or unauthorised access to personal data.

DPIA: A data protection impact assessment for analysing and reducing high privacy risks.

Privacy by design: Building privacy safeguards into systems and processes from the outset.

Cross-border transfer: Making personal data available or sending it to another country.

Data portability: Supplying qualifying personal data in a structured, commonly used and machine-readable format.

Review Questions

Short Answer Questions

1. What is the difference between personal data and anonymised data?
2. Why is purpose limitation important?
3. Identify four lawful bases for processing under GDPR-style rules.
4. What is a personal data breach?
5. State two purposes of a data protection impact assessment.

Long Answer Questions

1. Explain the core principles of lawful processing and show how they operate together.
2. Compare consent with legitimate interests as lawful bases for processing.
3. Describe the organisational process for responding to an individual access request.
4. Explain how security, retention and accountability contribute to privacy compliance.
5. Discuss the principal legal and operational issues in cross-border transfers.

Analytical / Application Questions

1. A retailer collects customers’ dates of birth, precise location and health interests for a loyalty programme. Analyse whether each category is necessary, identify possible lawful bases and recommend a minimised design.
2. An employee accidentally emails a spreadsheet containing customer health information to the wrong recipient. Design an incident-response plan, including containment, risk assessment, notification and remediation.
3. A university proposes using facial-recognition technology to monitor attendance. Evaluate the proposal using purpose limitation, proportionality, sensitive-data rules, individual rights, DPIA requirements and alternative solutions.

Multiple Choice Questions with Answers

Question 1

Which principle requires an organisation to collect only information that is adequate, relevant and necessary for its purpose?

A. Data minimisation

B. Storage limitation

C. Data portability

D. Purpose transfer

Correct Answer: A. Data minimisation

Question 2

Which statement best describes pseudonymised data under GDPR-style rules?

A. It is always anonymous and outside data-protection law

B. It remains personal data when re-identification is reasonably possible

C. It can never be used for research

D. It is the same as encrypted data in every respect

Correct Answer: B. It remains personal data when re-identification is reasonably possible

Question 3

Which is generally required for valid consent?

A. Silence after receiving a privacy notice

B. A pre-ticked box

C. A freely given, specific and informed affirmative indication

D. Consent that cannot be withdrawn

Correct Answer: C. A freely given, specific and informed affirmative indication

Question 4

What is the principal role of a processor?

A. To determine all purposes independently

B. To process personal data on the controller’s documented instructions

C. To replace the data-protection regulator

D. To guarantee that no breach can occur

Correct Answer: B. To process personal data on the controller’s documented instructions

Question 5

Which right normally allows an individual to request correction of inaccurate personal data?

A. Right to rectification

B. Right to portability

C. Right to object to marketing only

D. Right to restriction only

Correct Answer: A. Right to rectification

Question 6

Under the GDPR, a controller generally has how long to notify a supervisory authority of a notifiable breach after becoming aware of it?

A. 24 hours

B. 48 hours

C. 72 hours

D. 30 days

Correct Answer: C. 72 hours

Question 7

Which activity is most likely to require a data protection impact assessment?

A. Printing a public timetable with no personal data

B. Large-scale biometric identification of individuals

C. Deleting obsolete blank forms

D. Updating a company logo

Correct Answer: B. Large-scale biometric identification of individuals

Question 8

Which practice best supports storage limitation?

A. Keeping all data indefinitely because storage is inexpensive

B. Creating a documented retention schedule linked to purposes and legal duties

C. Deleting data immediately even when a legal hold applies

D. Allowing every employee to decide retention periods informally

Correct Answer: B. Creating a documented retention schedule linked to purposes and legal duties

Question 9

Why can an overseas cloud provider create a cross-border transfer issue even when servers are locally located?

A. Cloud services cannot use encryption

B. Overseas personnel or entities may have remote access or control

C. Local servers are never secure

D. All cloud storage is automatically unlawful

Correct Answer: B. Overseas personnel or entities may have remote access or control

Question 10

Which statement best reflects privacy by design?

A. Privacy is considered only after a product is launched

B. Privacy safeguards are incorporated into systems and processes from the outset

C. Privacy is achieved solely through a lengthy notice

D. Privacy duties apply only to marketing departments

Correct Answer: B. Privacy safeguards are incorporated into systems and processes from the outset