Explain why personal data must be protected, the risks of misuse, and measures and good practice for keeping data private

What this dot point is asking

SEAB wants you to explain why personal data must be protected, the risks if it is misused, and the measures and good practice that keep data private and secure. The central idea is that personal data identifies real people, so its loss or misuse can cause serious harm such as identity theft, and both organisations and individuals share responsibility for protecting it.

The answer

What personal data is

Personal data is information that identifies a living individual, such as a name, address, identity card number, date of birth, phone number or photograph. Some personal data is sensitive, such as health or financial information, and needs extra care.

Why it must be protected

Personal data is valuable and private. If it is lost, stolen or misused, the consequences for the individual can be severe, which is why protecting it is both an ethical duty and, in many places, a legal one.

Risks of misuse

• Identity theft: a criminal uses stolen details to impersonate the victim, opening accounts or making purchases in their name.
• Fraud and financial loss: stolen bank or card details are used to take money.
• Loss of privacy: exposed data can lead to scams, blackmail, stalking or embarrassment.
• Reputational harm: information taken out of context can damage someone's standing.

Organisations' responsibilities

An organisation that holds personal data should:

• keep it secure (encrypted, access-controlled, backed up),
• collect only what is needed and use it only for the stated purpose,
• keep it accurate and not for longer than necessary,
• and let individuals see and correct their data.

These principles reflect data protection laws, including Singapore's Personal Data Protection Act.

Good practice for individuals

• Use strong, unique passwords and two-factor authentication.
• Do not overshare personal information online.
• Check the privacy settings on your accounts.
• Be wary of phishing messages and suspicious links.
• Only give data to trusted sites (look for HTTPS), and log out on shared devices.

Why social media care matters

What you post can be copied, combined and kept permanently, even if you later delete it. Oversharing details such as your location or routine can expose you to scams, stalking or identity theft, and old posts can affect your reputation in future.

Examples in context

Example 1. A data breach at a shop. A retailer's customer database is hacked and names, addresses and card details are leaked. Customers face fraud and identity theft, and the company faces legal penalties and lost trust, showing why secure storage and collecting only what is needed matter.

Example 2. Oversharing on social media. A student posts their school, daily route and holiday dates publicly. A stranger could use this to track or scam them, and the posts may resurface years later. Tightening privacy settings and sharing less protects both safety and reputation.

Try this

Q1. State what personal data is, with one example. [2 marks]

• Cue. Information that identifies a living individual, such as a name, address or identity card number.

Q2. Give one risk of personal data being stolen. [2 marks]

• Cue. Identity theft, fraud or financial loss, or loss of privacy.

Q3. State two things an individual can do to protect their privacy online. [2 marks]

• Cue. Use strong unique passwords, check privacy settings, avoid oversharing, or beware of phishing links (any two).