- Hello and welcome back to the channel,
I'm Marcus from InfoSec Governance.
And this channel is all about spreading the knowledge
about protecting your business
from cyber security related threats.
Today's video is gonna be a quick one
about the Data Protection Act.
What is it?
Why you should be aware of it.
And why you need to actually comply with it.
Now, I decided to make this video as I've talked
to quite a lot of businesses over the last year or so,
which are still either not aware of the latest revision
of the act or they're just not aware of, you know,
the need to actually comply with it
or what they have to do to actually comply
with that act themselves.
Either way, if you don't actually comply with this act,
you could get into a lot of trouble
if you're not fully aware of it
and you're not actually compliant with all the controls.
So what is the Data Protection Act?
The Data Protection Act, or DPA for short,
is a UK, or United Kingdom, Act of Parliament.
The act was passed way back in 1998 originally,
well before the internet and online usage
and social media and all that became mainstream.
And the act was developed primarily just to control
how your personal information was gonna be used
by organisations or the government related bodies.
And how it actually gets processed by, you know,
computer systems and things like that of the day.
It was set up to protect people,
as well as laying down the initial rules
about how people's data could actually be used
and processed, like it is now, sort of thing.
The act applies to all information
which is related to living people
whether stored on a computer system
or whether or not it's actually a paper based filing system.
If you, as a business do not adhere
or process, store the information properly
in lines with the act,
then the Information Commissioner's Office,
or the ICO, can actually come and investigate your business
and potentially actually fine yourself,
the directors or the business,
or worst case actually suggest imprisonment.
So, one thing you should know is that
directors of the business have sole responsibility
when it comes to the protection of information.
If it's found that your business has breached
Data Protection Act or the GDPR,
which we'll quickly explain later,
then the people at the very top of the business
are in charge, they're, the line stops there.
You know, even if it's some person
down in the bottom of the company
that's actually done something accidentally,
it's not their fault.
It's the owners of the business
or the directors of the business.
Now, back in 2018, the act went under a major revision
which helped it actually align
towards the General Data Protection Regulation or GDPR.
Which was actually released by the EU and was built-in
just to help give more freedom to data subjects.
This ensured that more protection and controls
were put in place against personal data.
And it's actually an area where I'm actually
still seeing businesses or a lot of people
actually still referring to the Data Protection Act of 1990.
Not the Data Protection Act 2018.
Now, it's amazing the amount of people
and websites and stuff
that still have this referenced incorrectly.
So, you know, take this time to have a look at your website,
have a look at your documentation,
your contracts and everything else.
Just make sure that you're actually referencing
the correct Data Protection Act.
So why is the act important?
The act is important because it not only provides
some guidance and rules on how organisations
and the government departments should be storing
and processing and using your business data
or your data, but it also includes the following.
It aligns your processes or the processes of the business
around dealing with how to store and process personal data.
It also helps protect the rights of people,
otherwise known as data subjects.
It allows the ICO to enforce the rules
and apply the necessary fines if any business
is found to be in breach of these controls.
And it helps the organisation to be liable
for any breaches that have been found.
It also gives the data subject, or yourself
the right to be forgotten, as well as requesting information
about what that business holds on you.
And it also ensures that the data is properly protected
by the business and helps ensure that the data
is only kept for as long as actually required.
Now, this in general pretty much says it gives you,
the data subject, or your customer, your staff,
their supplier, whoever it is that you're storing
that information on, the access and the power
to actually see how their information has been stored.
How is it being processed?
How long it's been kept for and things like that.
Now, I'll link some references below this video
just for further information for you.
But if you aren't aware or fully up to date
with the Data Protection Act or the GDPR,
then I would certainly recommend
you have a read of their links below the video
and get up to speed with it.
The ICO has quite a lot
of useful information on their website.
It's non-technical, it's fairly easy and straightforward
and go from there.
Now, this is a massively quick overview
of what the Data Protection Act is.
You know, it's not meant to go
into a lot of depth or anything like that,
but it's just meant to give you a bit of an overview
of what it is, why you should be using it
and going from there.
So I hope you enjoy this video and, yeah,
feel free to give us a like and subscribe
and I'll see you next time.
(energetic music)