Data Protection: UK GDPR and the DPA 2018

Lesson plan

Level

Beginner

Time

About 65 minutes; the steps below add up to 65

Learners say what they would want a dentist or shop to promise about their details, and what to ask when a shop wants a date of birth, before the law is named. Predictions then precede pupil numbers, which data could do most harm, how many principles they can make out, whether consent is always needed, who decides a school’s purposes, the club’s register and where a request might lead; checks follow the regulator, the asthma note, marketing, the number of bases, tick-to-continue, a supplier’s own use and selling email addresses. The habit to build: for every use of personal data, name the purpose, the basis, the roles and the end date. This lesson is educational, not legal advice.

Objectives

• Describe the UK data-protection framework and the regulator
• Recognise personal data and special category data
• Apply the seven data-protection principles
• Choose a lawful basis for a purpose, including the 2025 addition
• Distinguish controllers from processors, and name individuals’ rights

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Data Classification lesson first.
• Law changes: check the ICO’s current guidance before the session if you add detail.
• The lesson takes about 65 minutes. To teach it in two parts, stop after “Lawful bases and current law”; the second part opens with “Controllers, processors and service providers”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Describe the UK data-protection framework and the regulator
   • Recognise personal data and special category data
   • Apply the seven data-protection principles
   • Choose a lawful basis for a purpose, including the 2025 addition
   • Distinguish controllers from processors, and name individuals’ rights

   Purpose: Learners say what they would want a dentist or shop to promise about their details, and what to ask when a shop wants a date of birth, before the law is named. Predictions then precede pupil numbers, which data could do most harm, how many principles they can make out, whether consent is always needed, who decides a school’s purposes, the club’s register and where a request might lead; checks follow the regulator, the asthma note, marketing, the number of bases, tick-to-continue, a supplier’s own use and selling email addresses. The habit to build: for every use of personal data, name the purpose, the basis, the roles and the end date. This lesson is educational, not legal advice.

2. 1. Trusting them with it Think 5 min

   Purpose: Draw the purpose of the law from learners’ own expectations.

   Ask

   • What would you want them to promise?
   • What do you ask about the kettle?

   Responses to expect

   • Safety comes first; “no more than needed” and “not for ever” need prompts.
   • On screen in turns: the opening question, its answer; then the question on a date of birth for a kettle, and its answer.

   Discussion pause: List the promises before revealing; they become the principles later.

   In the lesson window

   • Think it through: When you give your details to a dentist, a school or a shop, what would you want them to promise about how they use and look after that information?
   • Think it through: A shop asks for your date of birth to sell you a kettle. What is the obvious question?

3. 2. The UK data-protection framework Explain 4 min

   Purpose: Name UK GDPR, the DPA 2018, the ICO and processing.

   Ask

   • Who regulates?

   Responses to expect

   • Some say the NCSC.
   • On screen in turns: the opening; then two pieces of law, starting with the UK GDPR; the Data Protection Act 2018; the regulator; the check question on the regulator, and its answer; legal duties, not optional extras; processing.

   In the lesson window

   • Check your understanding: Which body regulates data protection in the UK, and can investigate and fine?

4. 3. Personal data and special category data Predict 8 min

   Purpose: Define personal data, identifiability and special category data.

   Ask

   • Are pupil numbers personal data?
   • Which data could do most harm?
   • Which part of the register is special?

   Responses to expect

   • Removing names is widely believed to anonymise.
   • On screen in turns: the opening; then the question on pupil numbers, and its answer; removing names is not anonymising; a label does not settle it; the question on what could do most harm, and its answer; special category data; a register, with and without a health note; the check question on the asthma note, and its answer; what is not special category data; the extra requirement for special category data.

   Misconceptions to challenge

   • A learner may believe: “Removing names makes data anonymous.” Respond: If people can still be identified, it is still personal data.

   In the lesson window

   • Think it through: A list shows only pupil numbers, not names. Is it personal data?
   • Think it through: Which kinds of information about a person do you think could do them most harm, or lead to discrimination, if misused?
   • Check your understanding: A register records that a named pupil attended on Tuesday and has asthma. Which part is special category data?

5. 4. The seven data-protection principles Predict 7 min

   Purpose: Turn the opening promises into the seven principles, applied to a register.

   Ask

   • How many principles can you make out?
   • Which principle does marketing test?

   Responses to expect

   • Accountability is the one most often missed.
   • On screen in turns: the opening question, its answer; then seven principles, with the register examples held back; each principle applied to the register; the check question on using the register for marketing, and its answer; where the principles are in the law.

   Discussion pause: The register column is held back: for each principle, ask what it would mean for the attendance register before revealing it.

   In the lesson window

   • Think it through: Using the promise from the start of the lesson (a proper reason, no more than needed, accurate, safe, not kept for ever, able to show it), how many separate principles can you make out?
   • Check your understanding: The training organisation wants to use its attendance register to send marketing. Which principle does that most directly test?

6. 5. Lawful bases and current law Predict 12 min

   Purpose: Teach the seven lawful bases, including the 2025 addition, and how to apply them to a purpose.

   Ask

   • Is consent always needed?
   • How many bases now?
   • Is tick-to-continue consent?

   Responses to expect

   • Consent is the default answer for most learners.
   • On screen in turns: the opening question, its answer; then a proper reason: the lawful basis; two common mistakes, starting with consent; a basis belongs to a purpose; seven bases, not six; six long-standing bases; contract; legal obligation; vital interests; public task; legitimate interests; the seventh basis; the check question on an older course book, and its answer; applying each basis, starting with consent; contract; legal obligation; vital interests; public task; legitimate interests; recognised legitimate interest; the check question on a tick-to-continue box, and its answer; public authorities use public task; where to find the tests in the law.

   Misconceptions to challenge

   • A learner may believe: “Consent is always needed.” Respond: It is one basis of several, and must be a real choice.
   • A learner may believe: “The six lawful bases are the full list.” Respond: Recognised legitimate interest was added in 2025.

   To go further

   • Why can public authorities not rely on legitimate interests for their official work?

   In the lesson window

   • Think it through: Must an organisation always ask for consent before using someone’s personal data?
   • Check your understanding: An older course book lists six lawful bases. What does current law say?
   • Check your understanding: A website will not let you continue until you tick “I consent to marketing”. Is that valid consent?

7. 6. Controllers, processors and service providers Predict 7 min

   Purpose: Separate controller from processor by whose purpose it is.

   Ask

   • Who decides the school’s purposes?
   • What changes when the supplier uses the data itself?

   Responses to expect

   • Contract labels are often taken as decisive.
   • On screen in turns: the opening question, its answer; then two roles, starting with the controller; the processor; whose purpose is it?; what the organisation does decides its role; the check question on the company’s own product, and its answer; the controller stays responsible; what the processor contract must cover.

   Misconceptions to challenge

   • A learner may believe: “Using a processor transfers responsibility to them.” Respond: The controller remains accountable.

   In the lesson window

   • Think it through: A school keeps pupil records in an online system run by a software company. Which of them decides why the records exist and what goes in them?
   • Check your understanding: The software company starts using the pupil records to train its own product. What has changed?

8. 7. Putting it together: a new register Predict 7 min

   Purpose: Work through the club’s register and its variation.

   Ask

   • Which questions come before collecting anything?
   • Why does selling email addresses need a new basis?

   Responses to expect

   • The second condition for health data is often missed.
   • Reveal Ms Farah’s decisions one at a time; ask the class to make each decision before it appears.
   • On screen in turns: the opening question, its answer; then Ms Farah’s register, starting with whether it is personal data; special category data; the least needed; the lawful basis; the health information; controller and processor; how long it is kept; showing her working; the result; changing one fact; the check question on selling email addresses, and its answer.

   If the explanation does not land: Give pairs one question each from the list and have them answer it for the club.

   In the lesson window

   • Think it through: A sports club wants an online register for an after-school session, with a column for medical notes. Using this lesson, list the questions to answer before collecting anything.
   • Check your understanding: In the “change one fact” variation, why does the register’s lawful basis not cover selling parents’ email addresses?

9. 8. Individuals' rights Predict 4 min

   Purpose: Name the rights, and why systems must be able to find one person’s data.

   Ask

   • Ask where the club might have to look.

   Responses to expect

   • The processor’s app is often forgotten.
   • On screen in turns: the opening; then the right of access; the question on finding everything, and its answer; find, correct, copy and delete; limits, exceptions and recent changes.

   In the lesson window

   • Think it through: A parent asks for everything the club holds about their daughter. Where might the club have to look?

10. 9. When things go wrong Explain 1 min

    Purpose: Point to the next lesson on breaches.

    Ask

    • Which lesson covers breaches?

    Responses to expect

    • The next one.
    • On screen in turns: the opening; then four questions before a new use.

11. 10. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The tax report tests bases; the fingerprints test special category; the payroll company tests roles.
    • On screen in turns: the opening; then the question on pay sent to the tax authority, and its answer; the question on a gym’s fingerprint scanners, and its answer; the question on a payroll company’s role, and its answer.

    In the lesson window

    • Apply it: An employer sends pay details to the tax authority because the law requires it. Which lawful basis applies?
    • Apply it: A gym introduces fingerprint scanners to let members in. What extra requirement does that bring?
    • Apply it: A payroll company runs salaries for a hotel, on the hotel’s instructions. It also keeps records of its own staff. What is it?

12. 11. Check your understanding Check 4 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The lawful-basis questions link to the bases step.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

13. 12. What to remember Consolidate 2 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: three of the seven lawful bases.

    Responses to expect

    • Any three, with consent named as only one of them.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

14. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • A legal duty, regulated by the ICO.
    • Identifiable people; some data needs extra care.
    • Seven principles from one plain promise.
    • A basis for every purpose, chosen first.
    • Controllers decide; processors act; responsibility stays.

Consolidation

• A legal duty, regulated by the ICO.
• Identifiable people; some data needs extra care.
• Seven principles from one plain promise.
• A basis for every purpose, chosen first.
• Controllers decide; processors act; responsibility stays.