Chapter 2 — Computing systems | Bachelor's Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Where data live"]
  N2["2.2 Local and cloud"]
  N3["2.3 Devices"]
  N4["2.4 Duties follow design"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Where data live"]
  N2["2.2 Local and cloud"]
  N3["2.3 Devices"]
  N4["2.4 Duties follow design"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 Where data live]
    |
    v
[2.2 Local and cloud]
    |
    v
[2.3 Devices]
    |
    v
[2.4 Duties follow design]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) map where pupil data live in school systems; (2) distinguish local, cloud and vendor storage; (3) relate system design to data protection duties.

2.1 Where data live

Elena maps the trust's systems. The management information system holds pupil records; a cloud office suite holds documents and email; classroom apps hold learning data; a payment system holds lunch accounts; and shared drives hold photographs. Some data sit on servers in schools, some in the cloud and some with vendors. She draws a simple diagram and finds that nobody in the trust has a complete view. Her map becomes the first version of the inventory that Article 30 of the GDPR requires.

2.2 Local and cloud

Local servers give the trust direct control but need maintenance, which small schools struggle to provide. Cloud services are maintained by providers but move data to another organisation, which becomes a processor under the GDPR. Elena lists responsibilities for each model. She notes that cloud is not automatically less private: a well-configured cloud service may be safer than an unpatched school server. The decision should follow the risks and the contracts in place, not a general preference for one model. Contracts decide much.

2.3 Devices

Pupils use shared tablets and teachers use laptops. Elena checks what data remain on devices: cached documents, saved passwords and photographs. A lost teacher laptop without encryption could expose many children's records. She recommends full-disk encryption on staff laptops and automatic sign-out on shared tablets. She learns that devices are part of the computing system and often its weakest point, because they leave the school and are used by many people with different levels of care. Pupil laptops go home each night, often shared with siblings.

2.4 Duties follow design

Elena concludes that system design shapes data protection duties. If data are spread across many vendors, the trust needs many contracts and must handle rights requests across all of them. If they are centralised, one system holds everything and must be well protected. Dr. Asante points out that Article 25 of the GDPR asks controllers to consider data protection when choosing the means of processing, which includes choosing and configuring systems, not only writing policies after the systems are installed. This is Article 25 in practice.

Worked example

Elena maps five systems holding pupil data, compares local and cloud responsibilities, recommends encryption and auto sign-out on devices and links system choice to Article 25.

Synthetic case. The trust's systems are synthetic; GDPR Articles 25 and 30 are real.

Errors and limits

A first map misses shadow systems such as personal spreadsheets; revisit it.

Exercises

EX004 — Missing view. What did Elena's system map reveal?
Show marking criteria
Rubric: 3 = nobody had a complete view of where pupil data live;; 2 = mentions gaps;; 1 = vague;; 0 = none.
EX005 — Cloud not automatic. Why is cloud storage not automatically less private?
Show marking criteria
Rubric: 3 = a well-configured cloud may be safer than an unpatched school server;; 2 = mentions configuration;; 1 = says cloud is worse;; 0 = none.
EX006 — Device controls. Which device controls does Elena recommend?
Show marking criteria
Rubric: 3 = full-disk encryption on laptops and auto sign-out on shared tablets;; 2 = one;; 1 = vague;; 0 = none.

Synthesis

Chapter 2 maps systems. Chapter 3 starts programming.

Continue studying — chapter 02 of 40

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →