Data Protection Act (DPA) and GDPR

Active learning helps students grasp legal and ethical nuances in data protection by moving beyond abstract rules to real-world applications. Hands-on tasks like debates and case studies make complex principles memorable and build confidence in applying them to everyday situations.

• Year 10
• Computing
• 4 activities
• 30 min–50 min

Learning Objectives

1. Explain the core principles of the Data Protection Act 2018 and GDPR, including lawful processing, data minimisation, and accuracy.
2. Analyze the implications of international data transfers, considering varying legal standards and potential risks.
3. Evaluate the ethical trade-offs between national security requirements and individual rights to digital privacy.
4. Critique real-world data breach scenarios to identify how DPA and GDPR principles were violated and suggest preventative measures.

Formal Debate

⏱ 45 min·Whole Class

Formal Debate: Security vs Privacy

Split the class into two teams to argue national security needs versus individual privacy rights under DPA/GDPR. Distribute evidence cards with principles and cases. Teams prepare 5 minutes, present 3-minute speeches, rebut, then vote and reflect.

Prepare & details

How do we balance the need for national security with the individual right to digital privacy?

Facilitation Tip: Before the security vs privacy debate, provide students with balanced articles on surveillance programs and privacy impacts to ground their arguments in evidence.

Setup: Two teams facing each other, audience seating for the rest

Materials: Debate proposition card, Research brief for each side, Judging rubric for audience, Timer

• Analyze
• Evaluate
• Create
• Self-Management
• Decision-Making

Formal Debate

⏱ 50 min·Small Groups

Case Study Rotation: Breach Analysis

Set up 3-4 stations with cases like Equifax or BA airline breach. Small groups rotate every 10 minutes, identifying violated principles, suggesting fixes, and noting prevention strategies using worksheets.

Prepare & details

Explain the key principles of the Data Protection Act and GDPR.

Facilitation Tip: For breach analysis case studies, assign roles within groups (e.g., legal advisor, IT manager) to ensure every student contributes to the discussion.

Setup: Two teams facing each other, audience seating for the rest

Materials: Debate proposition card, Research brief for each side, Judging rubric for audience, Timer

• Analyze
• Evaluate
• Create
• Self-Management
• Decision-Making

Formal Debate

⏱ 30 min·Pairs

Role-Play Pairs: Rights Requests

Pairs simulate: one as data subject requesting access or erasure, the other as compliance officer applying GDPR. Switch roles after 5 minutes, then debrief challenges in principles application.

Prepare & details

Analyze the implications of data being stored in jurisdictions with different legal standards.

Facilitation Tip: In rights request role-plays, provide scripted scenarios with incomplete information to mimic real-world complexity and require students to ask clarifying questions.

Setup: Two teams facing each other, audience seating for the rest

Materials: Debate proposition card, Research brief for each side, Judging rubric for audience, Timer

• Analyze
• Evaluate
• Create
• Self-Management
• Decision-Making

Formal Debate

⏱ 35 min·Individual

Data Mapping: Personal Audit

Individuals list apps and services they use, noting data types, storage locations, and jurisdiction risks. Share maps in plenary to discuss collective vulnerabilities.

Prepare & details

How do we balance the need for national security with the individual right to digital privacy?

Facilitation Tip: During data mapping, have students use highlighters and sticky notes to trace data flows visually, which helps them spot gaps or risks more easily.

Setup: Two teams facing each other, audience seating for the rest

Materials: Debate proposition card, Research brief for each side, Judging rubric for audience, Timer

• Analyze
• Evaluate
• Create
• Self-Management
• Decision-Making

Teaching This Topic

Teachers should balance legal instruction with ethical reflection, as students often struggle to see GDPR as more than compliance paperwork. Use contrasting examples—such as a school’s pupil data handling versus a tech firm’s data monetisation—to highlight why principles matter in different contexts. Research shows that when students engage with real data dilemmas, they retain concepts longer than through lecture alone.

What to Expect

Students will articulate GDPR and DPA principles, evaluate data handling scenarios, and justify decisions based on legal and ethical considerations. They will also practice responding to data subject rights requests and assess compliance risks in practical contexts.

Watch Out for These Misconceptions

Common Misconception

During the Data Mapping activity, watch for students assuming their school’s data practices automatically comply because 'we’re not a big company.'

What to Teach Instead

Use the data mapping exercise to have students trace how pupil data flows through systems like MIS platforms or cloud storage, then ask them to check contracts and data sharing agreements for GDPR clauses.

Common Misconception

During the Case Study Rotation activity, watch for students assuming any cloud storage provider is GDPR-compliant because it’s 'just in the cloud.'

What to Teach Instead

Have students examine the provider’s data processing agreement and data residency statements during the breach analysis, then identify gaps or risks in the case study’s scenario.

Common Misconception

During the Structured Debate activity, watch for students assuming anonymised data is always safe from re-identification.

What to Teach Instead

Use the debate scenario about sharing Netflix Prize data to challenge students to find flaws in anonymisation techniques and propose stronger methods during their arguments.

Assessment Ideas

Discussion Prompt

After the Structured Debate: Security vs Privacy, ask students in small groups to draft a short policy recommendation for balancing surveillance and privacy, citing at least two GDPR principles and one DPA clause.

Exit Ticket

During the Role-Play Pairs activity: Collect students’ completed request forms and their justifications for granting or denying the data subject’s request, then review for accurate application of GDPR rights and principles.

Quick Check

After the Data Mapping activity: Present students with a new scenario (e.g., a school sharing pupil data with an edtech company) and ask them to identify the lawful basis, potential risks, and required safeguards based on their mapping experience.

Extensions & Scaffolding

• Challenge students to draft a GDPR-compliant privacy notice for a fictional app they design, then peer-review each other’s work using a provided checklist.
• Scaffolding: For students struggling with data mapping, provide a partially completed flowchart to start, with gaps they must fill using the DPA/GDPR principles.
• Deeper: Invite a local data protection officer or IT professional to share a current compliance challenge, then have students propose solutions in small groups.

Key Vocabulary

Personal Data	Any information relating to an identified or identifiable living individual. This includes names, addresses, and online identifiers.
Data Subject Rights	The rights granted to individuals under GDPR, such as the right to access, rectify, erase, or restrict the processing of their personal data.
Data Controller	The person or organization that determines the purposes for which, and the means by which, personal data is processed.
Data Processor	A person or organization that processes personal data on behalf of the data controller.
Lawful Basis for Processing	The legal justification required to process personal data, such as consent, contract, or legitimate interests.