Revision guide for BTEC Unit 11 Cyber Security & Incident Management

1. Revision of Legal issues for
Unit 11
P
R
Breach
Mar
2022

2. What laws
 Data Protection Act 2018
 General Data Protection Regulations 2018
 Computer Misuse Act 1990
 Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000
and amendments,
 Fraud Act 2006 and amendments
 Health and Safety at Work etc. Act 1974
P
R
Breach
Mar
2022

3. Significant overlap with:
 Data Protection Act 2018
 General Data Protection Regulations 2018
 Effectively for most organisations the GDPR 2018 is the Data Protection Act 2018
 Lawfulness, fairness and transparency
 Purpose limitation
 Data minimisation
 Accuracy
 Storage limitation
 Integrity and confidentiality (security)
 Accountability principle
P
R
Breach
Mar
2022

4.  Lawfulness
You must identify valid grounds for collecting and using personal data.
• You must ensure that you do not do anything with the data in breach of
any other laws.
• You must use personal data in a way that is fair.
• You must be clear, open and honest with people from the start about how
you will use their personal data.
P
R
Breach
Mar
2022

5.  Purpose Limitation
• You must be clear about what your purposes for processing are from the
start.
• You need to record your purposes as part of your documentation
obligations and specify them in your privacy information for individuals.
• You can only use the personal data for a new purpose if either:
• this is compatible with your original purpose,
• you get consent, or
• you have a clear obligation or function set out in law.
P
R
Breach
Mar
2022

6.  Data Minimisation
• You must ensure the personal data you are processing is:
• adequate – sufficient to properly fulfil your stated purpose;
• relevant – has a rational link to that purpose; and
• limited to what is necessary – you do not hold more than you need for
that purpose
P
R
Breach
Mar
2022

7.  Accuracy
• You should take all reasonable steps to ensure the personal data you hold
is not incorrect or misleading as to any matter of fact.
• You may need to keep the personal data updated
• although this will depend on what you are using it for.
• If you discover that personal data is incorrect or misleading, you must take
reasonable steps to correct or erase it as soon as possible.
• You must carefully consider any challenges to the accuracy of personal
data.
P
R
Breach
Mar
2022

8.  Storage Limitation
• You must not keep personal data for longer than you need it.
• You need to be able to justify how long you keep personal data.
• You need a policy to set standard retention periods where possible, You
should also periodically review the data you hold, and
• erase or anonymise it when you no longer need it.
• You must carefully consider any challenges to retention of data.
• You can keep personal data for longer if you are only keeping it for
• public interest archiving,
• scientific or historical research, or
• statistical purposes.
P
R
Breach
Mar
2022

9.  Integrity & Confidentiality
• You must ensure that you have appropriate security measures in place to
protect the personal data you hold.
• This is the ‘integrity and confidentiality’ principle of the GDPR – also known
as the security principle.
P
R
Breach
Mar
2022

10.  Accountability Principle
• The accountability principle requires you to take responsibility for what
you do with personal data and how you comply with the other principles.
• You must have appropriate measures and records in place to be able to
demonstrate your compliance.
P
R
Breach
Mar
2022

11. Computer Misuse Act 1990
 §S1 Unauthorised access to computer material
 § 2 Unauthorised access with intent to commit or facilitate commission of
further offences
 § 3 Unauthorised acts with intent to impair, or with recklessness as to
impairing, operation of computer
 § 3ZA Unauthorised acts causing damage, or creating risk of, serious
injury
 § 3A Making, supplying or obtaining articles for use in another CMA
offence
P
R
Breach
Mar
2022

12. Telecommunications (Lawful Business Practice)
(Interception of Communications) Regulations 2000
and amendments
P
R
Breach
Mar
2022

13. Fraud Act 2006 and amendments
 three classes
 fraud by false representation,
 fraud by failing to disclose information, and
 fraud by abuse of position.
False representation could be the method by which access is gained to
computer systems
P
R
Breach
Mar
2022

14. Health and Safety at Work etc. Act 1974
A range of issues are becoming significant H&S practice.
 Lone working and electronic reporting – impact if systems disrupted
 H & S Records no longer available in event of cyber attack
 Interference / damage of electronic control systems
P
R
Breach
Mar
2022