Data Privacy: Protecting Your Information

Active learning works for data privacy because students need to experience the consequences of poor choices to internalize risks. Role-plays and audits let them test real-world scenarios without real-world harm, building judgment through practice rather than lecture.

• JC 2
• Computing
• 4 activities
• 30 min–45 min

Learning Objectives

1. Analyze common methods of personal data misuse, such as phishing and data breaches.
2. Evaluate the effectiveness of various security measures for protecting personal information online.
3. Design a personal data protection checklist incorporating at least three distinct security strategies.
4. Explain the potential consequences of compromised personal data for individuals in Singapore.
5. Compare the privacy policies of two popular social media platforms relevant to Singaporean users.

⏱ 35 min·Pairs

Role-Play: Phishing Scenarios

Pairs receive printed phishing emails or texts; one acts as sender, the other evaluates risks and responds safely. Switch roles after 10 minutes, then debrief class-wide on indicators like urgent language or odd links. Provide PDPA reporting templates.

Prepare & details

Why is it important to protect our personal data online?

Facilitation Tip: During the Phishing Scenarios, give each pair a different role (attacker, victim, bystander) to encourage perspective-taking and deeper engagement.

⏱ 40 min·Small Groups

Privacy Audit: Device Check

Individually, students examine app permissions and social media settings on school devices or demos, listing vulnerabilities. In small groups, compile a class privacy scorecard and vote on priority fixes. Share anonymized results.

Prepare & details

What are some common ways our data can be misused?

Facilitation Tip: For the Privacy Audit, provide a checklist with screenshots of common privacy settings so students can verify their own devices step by step.

⏱ 45 min·Small Groups

Checklist Workshop: Safe Practices

Small groups brainstorm and design visual checklists for passwords, sharing, and verification. Test checklists on sample profiles, refine based on feedback, then present to class for a shared digital resource.

Prepare & details

What steps can you take to keep your personal information safe?

Facilitation Tip: In the Checklist Workshop, have students swap checklists with peers to compare findings, then discuss discrepancies in small groups.

⏱ 30 min·Whole Class

Breach Response Simulation

Whole class draws 'data breach' cards with leaked info types; groups prioritize recovery steps like account locks and monitoring. Simulate with timers, discuss prevention in plenary.

Prepare & details

Why is it important to protect our personal data online?

Facilitation Tip: During the Breach Response Simulation, assign each student a role (e.g., IT support, affected user, manager) to mimic real incident response teams.

Teaching This Topic

Teachers should avoid presenting data privacy as a set of rules and instead frame it as a skill to practice. Model your own cautious habits, like reading privacy policies aloud, to normalize scrutiny. Research shows that students learn best when they see adults model the behavior they’re teaching, so share your own mistakes and fixes to build trust.

What to Expect

By the end of these activities, students will confidently identify risks, apply protective measures, and articulate why small decisions protect their digital lives. They will move from awareness to action, showing measurable improvement in their ability to assess and respond to threats.

Watch Out for These Misconceptions

Common Misconception

During the Privacy Audit: Device Check, watch for students assuming incognito mode fully protects them.

What to Teach Instead

Have students open a site in incognito mode and use browser tools to inspect network requests, then compare that to a regular window to show how tracking continues.

Common Misconception

During the Role-Play: Phishing Scenarios, watch for students believing sharing details with friends is always safe.

What to Teach Instead

During the debrief, ask students to trace how one shared password could lead to a chain of breaches, using role-play cards to visualize the spread.

Common Misconception

During the Checklist Workshop: Safe Practices, watch for students thinking a single strong password is enough.

What to Teach Instead

Provide a password manager trial where students create unique passwords for three accounts, then discuss how reuse increases risk when one site is compromised.

Assessment Ideas

Exit Ticket

After the Phishing Scenarios activity, provide students with a new phishing email and ask them to label the red flags and write one action they would take to verify its legitimacy.

Discussion Prompt

During the Role-Play: Phishing Scenarios, facilitate a class discussion where students reflect on how their role-play decisions compared to real-world risks, asking each group to share one insight from their scenario.

Quick Check

After the Privacy Audit: Device Check, ask students to rank three of their own online activities (e.g., posting photos, using public Wi-Fi) from lowest to highest risk based on the privacy settings they found during the audit.

Extensions & Scaffolding

• Challenge students to create a short video demonstrating a phishing attack and how to respond, then share it with younger grades to reinforce learning.
• For students who struggle with password creation, provide a template with example strong passwords they can modify to fit their needs.
• Allow extra time for students to research a real-world data breach, then present its cause and outcome to the class, linking it to today’s lessons.

Key Vocabulary

Personal Data Protection Act (PDPA)	Singapore's law that governs the collection, use, and disclosure of individuals' personal data. It sets out standards for organizations to follow.
Phishing	A fraudulent attempt to obtain sensitive information, such as usernames, passwords, and credit card details, by disguising oneself as a trustworthy entity in electronic communication.
Two-Factor Authentication (2FA)	A security process that requires users to provide two different authentication factors to verify their identity. This often involves something they know (password) and something they have (phone).
Data Breach	An incident where sensitive, protected, or confidential data is copied, transmitted, viewed, stolen, or used by an unauthorized individual.
Privacy Settings	Configurable options within online services or applications that allow users to control who can see their information and how their data is used.