Computing · Year 10

Active learning ideas

Data Protection Act (DPA) and GDPR

Active learning helps students grasp legal and ethical nuances in data protection by moving beyond abstract rules to real-world applications. Hands-on tasks like debates and case studies make complex principles memorable and build confidence in applying them to everyday situations.

• National Curriculum Attainment Targets
• GCSE: Computing - Ethical, Legal, and Cultural Impacts

• 30–50 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Formal Debate
• 45 min · Whole Class

Formal Debate: Security vs Privacy

Split the class into two teams to argue national security needs versus individual privacy rights under DPA/GDPR. Distribute evidence cards with principles and cases. Teams prepare 5 minutes, present 3-minute speeches, rebut, then vote and reflect.

How do we balance the need for national security with the individual right to digital privacy?

Facilitation Tip

Before the security vs privacy debate, provide students with balanced articles on surveillance programs and privacy impacts to ground their arguments in evidence.

What to look for

Pose the following to small groups: 'Imagine a social media company wants to share user data with a research institution in a country with weaker data protection laws. What are the ethical and legal considerations they must address according to DPA and GDPR? What arguments could be made for and against sharing the data?'

• Analyze
• Evaluate
• Create
• Self-Management
• Decision-Making

Activity 02

• Formal Debate
• 50 min · Small Groups

Case Study Rotation: Breach Analysis

Set up 3-4 stations with cases like Equifax or BA airline breach. Small groups rotate every 10 minutes, identifying violated principles, suggesting fixes, and noting prevention strategies using worksheets.

Explain the key principles of the Data Protection Act and GDPR.

Facilitation Tip

For breach analysis case studies, assign roles within groups (e.g., legal advisor, IT manager) to ensure every student contributes to the discussion.

What to look for

On an index card, ask students to: 1. List three key principles of GDPR. 2. Describe one specific right a data subject has. 3. Identify one potential risk of storing data in a country with different legal standards.

• Analyze
• Evaluate
• Create
• Self-Management
• Decision-Making

Activity 03

• Formal Debate
• 30 min · Pairs

Role-Play Pairs: Rights Requests

Pairs simulate: one as data subject requesting access or erasure, the other as compliance officer applying GDPR. Switch roles after 5 minutes, then debrief challenges in principles application.

Analyze the implications of data being stored in jurisdictions with different legal standards.

Facilitation Tip

In rights request role-plays, provide scripted scenarios with incomplete information to mimic real-world complexity and require students to ask clarifying questions.

What to look for

Present a short scenario: 'A local charity collects email addresses for its newsletter. They also want to use these addresses to send fundraising appeals. Ask students to identify the data controller, the type of data collected, and the lawful basis needed for processing this data for both purposes.'

• Analyze
• Evaluate
• Create
• Self-Management
• Decision-Making

Activity 04

• Formal Debate
• 35 min · Individual

Data Mapping: Personal Audit

Individuals list apps and services they use, noting data types, storage locations, and jurisdiction risks. Share maps in plenary to discuss collective vulnerabilities.

How do we balance the need for national security with the individual right to digital privacy?

Facilitation Tip

During data mapping, have students use highlighters and sticky notes to trace data flows visually, which helps them spot gaps or risks more easily.

What to look for

Pose the following to small groups: 'Imagine a social media company wants to share user data with a research institution in a country with weaker data protection laws. What are the ethical and legal considerations they must address according to DPA and GDPR? What arguments could be made for and against sharing the data?'

• Analyze
• Evaluate
• Create
• Self-Management
• Decision-Making

A few notes on teaching this unit

Teachers should balance legal instruction with ethical reflection, as students often struggle to see GDPR as more than compliance paperwork. Use contrasting examples—such as a school’s pupil data handling versus a tech firm’s data monetisation—to highlight why principles matter in different contexts. Research shows that when students engage with real data dilemmas, they retain concepts longer than through lecture alone.

Students will articulate GDPR and DPA principles, evaluate data handling scenarios, and justify decisions based on legal and ethical considerations. They will also practice responding to data subject rights requests and assess compliance risks in practical contexts.

---

Watch Out for These Misconceptions

• During the Data Mapping activity, watch for students assuming their school’s data practices automatically comply because 'we’re not a big company.'

  Use the data mapping exercise to have students trace how pupil data flows through systems like MIS platforms or cloud storage, then ask them to check contracts and data sharing agreements for GDPR clauses.

• During the Case Study Rotation activity, watch for students assuming any cloud storage provider is GDPR-compliant because it’s 'just in the cloud.'

  Have students examine the provider’s data processing agreement and data residency statements during the breach analysis, then identify gaps or risks in the case study’s scenario.

• During the Structured Debate activity, watch for students assuming anonymised data is always safe from re-identification.

  Use the debate scenario about sharing Netflix Prize data to challenge students to find flaws in anonymisation techniques and propose stronger methods during their arguments.

---

Methods used in this brief

• Formal Debate