Data protection for web developers

As you may have discovered, cookies are files stored on your computer by a website. They are all unique, which means that they can be used to identify your device to the website. This can be used to keep you logged in, to remember your settings and details on the website, and to track what other websites you visit.

But you may also have seen that users need to have a say in how their data is used. You can decide whether websites can track you using cookies, or whether they can only be used to store basic information.

There are lots of laws, regulations and rules about data because it can be very personal and many people do not want websites to use their data for marketing. This section will talk in a little more detail about your responsibilities when you handle your users’ data.

The Data Protection Act is the most important piece of legislation to know about in the UK, and sets out a lot of rules about how you can use and store data. The full act, and a nice breakdown of the key principles, is available on the UK Government’s website.

This is quite similar to the UK’s version of the General Data Protection Regulation or GDPR, which is a European law which sets out a few more rules about how you should use data. This set of rules has some basic principles which you need to follow if your website is used in the UK or Europe, so it is very important to make sure you follow them!

The principles are:

• Lawfulness, fairness and transparency: You need to use people’s data in a way which is legal, which doesn’t discriminate against anyone, and you need to tell them what you’re doing with the data.
• Purpose limitation: You can only use data for the purposes which you have told your users about.
• Data minimisation: You should collect only necessary data; for example, you shouldn’t collect dates of birth unless you need them for a specific purpose.
• Accuracy: All data should be kept up to date.
• Storage limitation: Don’t keep data longer than you need to.
• Integrity and confidentiality: Data has to be kept securely.
• Accountability: You have to take responsibility for data and ensure that the other principles are followed.

The next video will explain the principles of accessibility in web development.

Optional exercise: Understanding GDPR

The points above are just the key points from the principles, so you if you want an in-depth understanding of GDPR, read through the UK Information Commissioner’s Office (ICO) more in-depth explanation of data protection principles and regulations.