Privacy Protection Practice

Any detail that can identify a person, alone or with other details. You will recognise ordinary details that identify a person and rank them by sensitivity, so you know which information deserves the strongest care.

• Names, phone numbers, photos, IDs, locations and online IDs.
• Sensitive data: health, beliefs, money, children, biometrics.
• Anonymous data cannot be traced back to a person; pseudonymous data (names swapped for codes) can.
• People have rights over their data.
• Collect examples from a normal day, such as email address, phone number, photo, delivery address, device identifier, location trace and customer number. Sort them by how easily they identify someone.
• Mark which items are especially sensitive, such as health, money or children's details, since they need stronger protection and a clearer reason to hold them.
• Check whether a photo with a visible name tag is personal data; it is.
• Learn the rights people have in your place, such as access and correction.

Activity. List ten data items from daily life and class each.

Standard to meet. Classify each item with a reason.

Common mistake. Thinking only names are personal data.

Check yourself. Which three items in your office are personal data?

A few core ideas guide most privacy laws. You will apply core privacy principles to a real form and remove fields you cannot justify, reducing what you hold and what could leak.

• Lawful, fair and clear use.
• Collect for a purpose; collect only what you need.
• Keep it accurate and only as long as needed.
• Keep it safe and be able to show what you did.
• Apply the habits of collecting only what you need, using it only for the stated reason, keeping it accurate, storing it briefly and keeping it safe.
• Test each form field by asking what would go wrong if you did not collect it; if the answer is nothing, remove the field.
• Write the purpose beside each field; if you cannot, remove the field.
• Train staff to ask "do I need this?" before collecting.

Activity. Review one real form and remove unneeded fields.

Standard to meet. Form shortened with reasons.

Common mistake. Collecting "just in case".

Check yourself. Which field can you remove?

You cannot protect data you cannot find. You will build a data map covering sources, storage, access, sharing and deletion, including spreadsheets and phones where leaks often start.

• List systems: paper, email, shared drives, apps, phones.
• For each: data kinds, people, purpose, who sees it, where stored, how long kept.
• Include suppliers who handle data for you.
• Mark transfers to other countries.
• List each data type with where it comes from, where it is stored, who can see it, who it is shared with and when it is deleted; aim for at least 8 rows to start.
• Include informal places such as spreadsheets, chat messages, personal phones and paper files, since these are where leaks often begin.
• Include paper files, notebooks and phone photos in the map.
• Note who outside the organisation receives data, such as payroll or cloud tools.

Activity. Build a data map with at least 8 rows.

Standard to meet. Complete all rows and name the owners.

Common mistake. A data map that skips email and phones.

Check yourself. Which store did you almost forget?

Score what could go wrong and act on the top items. You will score each data flow for likelihood and harm and fix the highest items first, so limited time goes to the biggest risks.

• Risk = chance times harm, each 1 to 5.
• Fix the top three first: delete, restrict, encrypt.
• Record decisions and who made them.
• Check suppliers' promises.
• Score each data flow for likelihood and harm from 1 to 5, multiply, and tackle anything scoring 10 or more first with a named fix and date.
• For new projects run a short checklist before starting: what data, why, who sees it, how long kept and what could go wrong for the person.
• Rank risks by number of people affected as well as harm.
• Record a date and owner for each fix.

Activity. Score ten data risks and fix three.

Standard to meet. Record the fixes with dates.

Common mistake. Scoring risk once and never acting.

Check yourself. What fixed which risk?

People should know what happens to their data. You will write a plain-language notice and a separate, recorded consent choice, so people understand and control what happens to their details.

• Notice in short plain words: who, why, how long, rights, contact.
• Consent must be clear and easy to withdraw.
• Do not tie consent to unrelated services.
• Children need extra care.
• Write notices in plain language at roughly a reading age of 12, covering what you collect, why, who receives it, how long you keep it and how to contact you.
• Make consent a separate, unticked choice where it is needed, record the date and wording shown, and make withdrawing as easy as agreeing.
• Add a short version of the notice on forms and a longer one on the website.
• Keep proof of when and how each consent was given.

Activity. Write a one-page notice and a consent line.

Standard to meet. Write at a reading level that suits a 12-year-old.

Common mistake. A notice nobody can read.

Check yourself. What reading age did you aim at?

People can ask to see, fix or delete their data. You will handle access, correction and deletion requests with a set deadline and a proportionate identity check, without exposing anyone else's data.

• Verify who is asking without collecting more than needed.
• Search all systems from the data map.
• Reply within your legal deadline.
• Keep a log of requests and outcomes.
• Set a standard response time, such as inside the legal limit for your place, log the date every request arrives, and name one person who owns each step.
• Verify identity in proportion to the risk before releasing anything, and check that you are not exposing someone else's details in the same file.
• Create a template reply and a checklist of systems to search.
• Keep requests confidential and only share what the person is entitled to.

Activity. Answer a mock request in time.

Standard to meet. Complete the reply and update the log.

Common mistake. Ignoring the deadline for requests.

Check yourself. What is your deadline?

Basic safety stops most leaks; a plan limits harm. You will apply basic safeguards and a breach checklist, so a lost laptop or misdirected email is contained and reported methodically.

• Passwords, second step, updates, encryption on phones and laptops.
• Breach plan: stop, assess, tell, learn.
• Know when and whom to tell in your place.
• Practise once a year.
• Apply basics such as locked devices, encrypted laptops, limited access by role and removal of leavers' accounts on their last day.
• Write a breach checklist: stop the leak, record what happened, assess the risk to people, notify those who must be told and note the lessons.
• Keep the contact of your regulator in the plan.
• After a breach, write a short lessons note within a week.

Activity. Write a breach plan and test it with a scenario.

Standard to meet. Plan names an owner and a deadline.

Common mistake. No breach practice.

Check yourself. Who is your breach owner?

Privacy is a habit. You will schedule regular map reviews and short staff refreshers, keeping privacy practice current as tools and habits change.

• Quarterly review: new systems, new suppliers, new staff.
• Short training for all staff.
• Keep records of training.
• Plan the next 90 days.
• Review the data map every six months and after any new tool or service, and update the notice whenever the practice changes.
• Train staff for 20 minutes twice a year using real examples from your own office, and ask each person to name one change they will make.
• Add privacy to the checklist for new projects and suppliers.
• Hold a five-minute reminder at staff meetings.

Activity. Run a mock audit and plan.

Standard to meet. Audit finds fixes with dates.

Common mistake. Doing it once.

Check yourself. When is your next review?

A school finds ten years of scanned IDs.

Question: What now?

Model answer: Check purpose and retention, delete what is not needed, secure what stays and update the map.

A parent asks for all data held on their child.

Question: What steps?

Model answer: Verify identity, search all stores in the map, reply within the deadline, and log it.

On the slide: L1 Basic · Basics of privacy

Notes: Protect your own accounts and phone: check app permissions, location sharing and who can see your posts. Notes: review your phone settings and change at least three. Standard: a before and after list.

On the slide: L2 Awareness · Awareness

Notes: Explain personal data, consent and the main rights people have over their data in plain words. Notes: share examples from daily life, such as a shop loyalty card or a school list. Standard: each example names the data, the purpose and who holds it.

On the slide: L3 Foundation · Foundation

Notes: Map the personal data of one small system, such as a club or a shop: what is collected, why, where it is kept and who sees it. Notes: use a real club or a model shop and draw the data flow on one page. Standard: no data item without a stated purpose and an owner.

On the slide: L4 Practitioner · Practitioner

Notes: Run a short privacy review of a small organisation: list risks, rank them and draft a plain notice. Notes: use a club or shop with its permission. Standard: five ranked risks, each with a fix, and a notice a member can understand.

On the slide: L5 Specialist · Specialist

Notes: Run a privacy review of one small organisation with a data map, risk list, notice, request process and breach plan. Notes: time a mock access request from receipt to reply and run a breach drill. Standard: request answered within the legal period of the place, and breach steps tested.

On the slide: L6 Advanced · Advanced

Notes: Handle complex data and suppliers: review contracts, transfers across borders and a supplier's security. Notes: add a contract checklist and a transfer record. Standard: each supplier has a written basis for the transfer and a review date.

On the slide: L7 Super expert · Super expert

Notes: Set the data-mapping and privacy-review method for an organisation and teach the reviewers who use it. Notes: re-read the law for the place each year and update the notice, request and breach templates.