Cyber Security (BD308) – Assignment Week 6 – Syafira Aulia

The General Data Protection Regulation (GDPR) is built on several key principles to ensure data is handled ethically. Data Minimization dictates that a business should only collect the specific data necessary to achieve a task, nothing more. Purpose Limitation means that data collected for one reason (e.g., shipping a product) cannot be used for another unrelated reason (e.g., selling the email to a third party) without new consent. Other principles include Accuracy (keeping data up to date), Storage Limitation (deleting data when no longer needed), and Integrity and Confidentiality (ensuring strong security measures).

Personal Data or Personally Identifiable Information (PII) refers to any information that can be used on its own or with other information to identify, contact, or locate a single person. It is the “digital footprint” that belongs exclusively to an individual.

Five Examples:

1. Full Name: A direct identifier.
2. Home Address: Physical location data.
3. Email Address: Digital contact information.
4. IP Address: A unique string identifying a device on a network.
5. Bank Account Details: Sensitive financial identifiers used in transactions.

To ensure “proper consent,” a digital business must follow the “Freely Given, Specific, Informed, and Unambiguous” standard. This means using clear, non-legal language to explain what data is being collected and why. Businesses should avoid “pre-ticked” boxes; instead, users must take a positive action (like clicking “I Agree”) to opt-in. Additionally, the business must provide an easy way for users to withdraw consent at any time. A clear, accessible Privacy Policy link near the sign-up button is a standard way to ensure the user is fully informed before they agree.