Chapter 5 — Security literacy | Technologist Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Threats"]
  N2["5.2 Staff guidance"]
  N3["5.3 Recognising breaches"]
  N4["5.4 Reporting"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Threats"]
  N2["5.2 Staff guidance"]
  N3["5.3 Recognising breaches"]
  N4["5.4 Reporting"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Threats]
    |
    v
[5.2 Staff guidance]
    |
    v
[5.3 Recognising breaches]
    |
    v
[5.4 Reporting]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) recognise threats to member data; (2) explain basic protections to club staff; (3) recognise personal data breaches.

5.1 Threats

Aisha lists threats to Quayside: phishing emails to club managers, weak passwords on booking screens, lost tablets used at reception, and staff sharing member lists on personal phones. She notes that most incidents in similar businesses involve ordinary mistakes rather than sophisticated attacks. She groups the threats by where they start. Phishing begins in email, weak passwords begin at the screen, lost tablets begin at the front desk and shared photos begin in staff habits. For each group she writes a realistic example from a club day, such as a manager clicking a fake invoice link during a busy Monday evening rush.

5.2 Staff guidance

Aisha writes a one-page guide for club staff: use the password manager, lock reception screens, never photograph member lists, report lost devices immediately and check email recipients. She tests it with two club managers and simplifies the wording. The first draft used security vocabulary that confused the managers, who asked what a password manager actually was and why locking a screen mattered when they were standing beside it. Aisha rewrote each rule as a short action with a reason, for example: lock the screen whenever you walk away, because members queue right next to it.

5.3 Recognising breaches

Aisha explains that a personal data breach includes accidental loss or disclosure, not only hacking. A lost tablet with member bookings or an email to the wrong member can be a breach. Quayside must assess each and notify the supervisory authority within 72 hours under Article 33 unless the breach is unlikely to result in a risk. She prepares three short examples for training: a reception tablet left on a bus, a class list emailed to the wrong trainer, and a door access log exposed by a misconfigured link. Staff discuss whether each involves personal data and who might be harmed, which shows them that breaches are everyday events, not only cyber attacks.

5.4 Reporting

Aisha sets up a simple reporting form for staff. She explains that quick reporting matters because the 72-hour clock starts when Quayside becomes aware. Mr. Reilly adds that staff who fear blame delay reports, so the guide thanks staff for reporting promptly. The form asks only for what happened, when it was noticed, which club and what data might be involved. It does not ask staff to judge severity, because that decision belongs to the data protection officer. In the first month the form receives six reports, four of which are misdirected emails that would previously have gone unrecorded.

Worked example

Aisha lists everyday threats, writes a one-page staff guide, explains that accidental losses are breaches and sets up a quick reporting form.

Synthetic case. Threats and guidance are synthetic; GDPR Article 33 is real.

Errors and limits

Guides need refreshing as threats change.

Exercises

EX013 — Lost tablet. Is a lost reception tablet with bookings a possible breach? Rubric: 3 = yes; accidental loss of personal data;; 2 = yes;; 1 = no;; 0 = none.
EX014 — Report timing. Why must staff report quickly? Rubric: 3 = the 72-hour clock starts when Quayside becomes aware;; 2 = mentions deadline;; 1 = vague;; 0 = none.
EX015 — Photographing lists. Which risky habit does the guide forbid? Rubric: 3 = photographing member lists on personal phones;; 2 = mentions phones;; 1 = vague;; 0 = none.

Continue studying — lesson 05 (chapter 05 of 30)

← Chapter 04 · Course chapter index · Chapter 06 →

Continue to the next authored lesson.