Skip to the page
Year 9 · Autumn 2 · Cybersecurity

The Computer Misuse Act and data protection

What this lesson covers

Topic 19 Digital life, law and ethics

KS3 Computing · Using technology well means staying safe, knowing the laws about computers, data and creative work, and asking who technology helps and who it harms.

Networks and Digital Communication Managing DataCambridge Lower Secondary Computing 0860

You will learn to

  • Identify which of the three sections of the Computer Misuse Act a scenario breaks.
  • Explain why the penalties get heavier from section 1 to section 3.
  • Summarise each data protection principle in about six words.
  • Compare the UK laws with Spain's: the Código Penal and the LOPDGDD.

Success criteria

  • I can sort the scenario cards by law and section, and give a reason.
  • I can write each data protection principle in about six words.
  • I can name the Spanish law that matches each UK law.

Key words

Say each word, then read what it means. Every one is in the glossary too.

Computer Misuse Act
UK law (1990) that makes hacking and spreading malware crimes.
Data Protection Act
UK law (2018), with UK GDPR, controlling how personal data is used.
Copyright
Automatic legal protection for original creative work.
Digital footprint
The trail of everything you do online.
Phishing
Fake messages that trick people into giving details.
Open source
Software whose code anyone can see, change and share.
Ethics
AI that is biased because its training data was. Cameras that keep us safe and also watch us. The digital divide: who is left out when everything moves online. Screen time and sleep. Practise arguing both sides.

The explanation

Read it here, or open the study page below to go one step at a time with things to try.

UK law

Computer Misuse Act 1990 makes hacking a crime:

  1. Unauthorised access: e.g. using someone's password 'just to look'.
  2. Unauthorised access to commit another crime: e.g. to steal money.
  3. Unauthorised acts that damage a computer: e.g. spreading malware, DoS attacks.

Data Protection Act 2018 and UK GDPR control personal data. Organisations must:

  • be open about what they collect and why;
  • only use it for that purpose;
  • collect only what they need;
  • keep it accurate;
  • not keep it too long;
  • keep it secure.
e.g.Example

The UK updated these rules with the Data (Use and Access) Act 2025 (Royal Assent 19 June 2025). It amends them; the core principles stay.

Copyright, Designs and Patents Act 1988 protects creative work automatically. Usually for the creator's lifetime + 70 years.

Study it

Open the study page and go one step at a time.

The steps for this lesson

Try it

Check yourself

One question at a time. The reason shows after each answer.

Saved on this device.