CO4820: GDPR Research Report on Data Protection and Privacy

This report provides a comprehensive overview of the General Data Protection Regulation (GDPR), examining its impact on data protection and privacy. The research, conducted through surveys and literature review, explores key aspects of GDPR, including the need for employee training, parental consent for children's data, and the implications of the regulation on businesses. The report analyzes the awareness of GDPR among students, assesses their understanding of data protection principles, and discusses the implications of the UK's decision to leave the EU on the implementation of GDPR. The findings highlight the importance of GDPR training, the simplicity and cost-effectiveness of the new rules for businesses, and the significance of data breach contingency plans. The research included surveys with 15 students to understand their awareness of GDPR, the impact of the new rules, and their views on employee training, and the storage of personal data. The study also explores the age at which people should learn about GDPR and the importance of data breach contingency plans. The report concludes with a discussion of the findings and their implications for data protection practices. The report also provides a breakdown of the demographic of the respondents, the courses they are studying and their awareness of the GDPR.

Running head: RESEARCH
General Data Protection Regulation

RESEARCH 2
Abstract
The main aim of this report is to gain depth
understanding regarding general data
protection regulation (GDPR). This report
evaluated that GDPR is a new structure for
data protection that can replace the prior
1995 data protection laws. It also discussed
that training is essential to gain the
awareness regarding EU general data
protection regulation as it would lead to
keeping the privacy of an individual. It is
also determined that GDPR needs the
consent of parental before data service
provider will deal with confidential data of
children in the age of 16. This report also
defines that both primary and secondary data
collection method will be used in this
research to gather the information regarding
GDPR. It is found that 15 students are
selected for conducting the survey. It is also
assessed that a new set of rules of GDPR is
simpler and cheaper for business.

RESEARCH 3
Table of Contents
Abstract............................................................................................................................................2
Introduction/Background literature half a page...............................................................................4
Research design...............................................................................................................................4
Results..............................................................................................................................................5
Which course are you studying in the university?...........................................................................6
Discussions....................................................................................................................................15
Conclusion.....................................................................................................................................16
References......................................................................................................................................17

RESEARCH 4
Introduction/Background literature half a
page
The GDPR is the new framework of data
protection laws that replace the prior 1995
data protection directives. Prior the UK law,
it was based on the directives. The EU’s
GDPR stated that legislation is intended to
harmonize data privacy laws in across the
Europe and provides higher protection and
rights to a person. Within the GDPR, there
are higher possibilities for business and
public that deals with personal data [1]. The
mutually agreed general data protection
regulation came into effects on May 25,
2018. This was intended to modernize the
laws that keep the personal data of an
individual. It also enhances the right of a
person and facilitates them more control
over their data. The company should ensure
the contingency plan to follow with respect
to a data breach. This plan focuses on
different kind of breaches that can occur and
also focuses on how to deal with them [2].
Wachter Mittelstadt and Floridi (2017)
evaluated that the EU general data
protection regulation needs awareness
training regarding workforce privacy. As per
the article 39, the GDPR considers the data
protection officer who supports in increasing
the awareness and training of employees
entailed in dealing out operations. This
GDPR training is organized for everyone
who deals with personal information. It also
facilitates a wider comprehension regarding
general data protection regulation and
GDPR [10]. It is all about keeping the
confidential information safe and protecting
the concern of an individual whose
information it is.
Goddard (2017) stated that the GDPR needs
the consent of parental before information
society service providers can deal with the
confidential information of children at the
age of 16. Moreover, GDPR is entirely
applicable for all children under the
nationwide selected age of 16 for all
information processing cases. It takes place
as per consent, excluding for counseling and
preventing services. Children may restrict in
their right associated with freedom of
expression on the internet. The GDPR
focuses on a provision that restricts the
processing of personal information of
children [8]. The practice of legitimate
interest of data controller as a ground for
legal children’s information processing is a
constraint in the GDPR.
Research design
In this research, the researcher has used both
primary and secondary data collection
method. In this way, primary data would be
collected by the survey through
questionnaire and secondary data would be
collected by the literature review. For
conducting the survey, the researcher has
taken prior consent to the students.
Furthermore, a literature review is gathered
by different second-hand sources such as
journal articles, newspapers, textbooks, and
academic publication [12].
Sampling
In this research, the simple random
probability sampling method is used to
choose the sample from a large number of
populations. This would lead to declining
the chance of biased from the investigation.
The survey is conducted on 15 students as a
sample size. The selected student has 21-30
years old. In this survey, both open and
close-ended questionnaire structure is used
to gather the information regarding GDPR.
Data would be presented via different charts
such as bar graph and column charts in order
to understand the pooled data [9].
Results
Table 1: Age-group
Age-group
21 years 2
22 years 2
24 years 3
25 years 4

RESEARCH 5
26 years 1
27 years 2
30 years 1
Chart 1: Age-group
21
years 22
years 24
years 25
years 26
years 27
years 30
years
2 2
3
4
1
2
1
Age-group
Age-group
As per the above chart, it can be
demonstrated that there are 4 out of 15
students who belong to 25 years age of the
group. On the other side, there are only 2
respondents who come under the age of 26
and 30 years. This shows that the researcher
has recruited a proficient student for
conducting the research.
Table 2: Which course are you studying
at the university?
Which course are you studying at the
university?
Accounting & Finance 6
Marketing 7
Economics 2
Chart 2: Which course are you studying
at the university?
Accounting &
Finance
Marketing
Economics
0 1 2 3 4 5 6 7 8
6
7
2
Which course are you
studying in the
university?
Which course are
you studying in
the university?
The above chart shows that most of the
students are studying Marketing course at
the university. In contrast to this, only 2
students are studying economics course at
the university.
Figure 1: Are you aware of GDPR
Figure 2
As per the above table and chart, it can be
demonstrated that most of the respondents
i.e. 86.67% stated that they have awareness
regarding general data protection regulation.
In contrast to this, only 13.33% of

RESEARCH 6
respondents stated that they do not have
awareness about the general data protection
regulation. Thus, companies should
emphasize creating awareness regarding
general data protection and it would aid to
secure the data from competitors.
Figure 3
Figure 4
From the above chart, it can be stated that
most of the students believe that GDPR is an
update on the data protection act 1998 that
shows personal data can only legally be
gathered and stored by corporations that are
certified in accordance with the GDPR
regulations. In contrast to this, there are only
3 students who were agreed with the
remaining statement.
Figure 5
Figure 6
The above chart shows that most of the
students i.e. 66.67% believed that yes, the
UK’s decision to leave the EU will not
affect the commencement of GDPR. On the
other side, only 1 out of 15 respondents was
not agreed with this statement.
Table 3: New set of rules of GDPR
A new set of rules of GDPR
Simpler and cheaper for
businesses
5
Collecting and analyzing
personal data
4
Prevent the data from being
abused
1
Easier access to their personal
data
2
The easy way of opting out of
their details being on a mailing
list
3
Chart 3: New set of rules of GDPR

RESEARCH 7
Simpler and cheaper for
businesses
Collecting and analysing
personal data
Prevent the data from being
abused
Easier access to their personal
data
Easy way of opting out of their
details being on a mailing list
5
4
1
2
3
New set of rules of
GDPR
New set of rules of GDPR
According to the above table and chart, it
can be depicted that most of the students
i.e.5 out of 15 believe a new set of rules of
GDPR is simpler and cheaper for business.
On the other side, it can be demonstrated
that only 1 out of 15 students believed that a
new set of rules of GDPR is preventing the
data from being abused. Thus, it can be
evaluated that there are there is a different
new set of GDPR that is beneficial for
students in the university.
Figure 7: How much training do you
think employees of companies should
have on GDPR?
Figure 8
As per the above table and chart, it can be
stated that there are 8 out of 15 students
stated that the company should provide
training regarding GDPR for more than a
day. In contrast to this, only 3 out of 15
students believed that the company should
provide training regarding GDPR for an
hour.
Figure 9 At what age should people learn
about GDPR
Figure 10
From the above table and chart, it can be
stated that there are 9 out of 15 students
believed younger than 15 years age of
people should learn regarding GDPR. On
the other side, there are only 2 students who
believed that over 18 years age of people
should learn regarding GDPR. This would
lead to effectively implement the GDPR
within an organization.
Figure 11
Figure 12

RESEARCH 8
The above chart shows that there are 80% of
students believed that they have a
contingency plan to be implemented in case
of a data breach. In contrast to this, only 3
out of 15 respondents did not believe in this
statement.
Figure 13
Figure 14
The above chart depicts that most of the
students i.e. 60% think that company keeps
data for 6 years or less. In contrast to this,
only 6.67% of students are unsure regarding
the statement.
Discussions
From the above data analysis, it can be
interpreted that most students have
awareness regarding general data protection
regulation. They believed that GDPR is an
update on the data protection act 1998 that
shows personal data can only legally be
gathered and stored by corporations that are
certified in accordance with the GDPR
regulations. This finding is supported by the
view of Crabtree et al. (2016) as it was
evaluated that the General Data Protection
Regulation (GDPR) is related to respecting
the duties of a person while processing the
personal data. It could be attained by being
sincere and open with workforces regarding
the use of data about them and by following
good data handling process. The regulation
is obligatory and all companies that keep
and process personal information must
comply [7].
As per the above data analysis, it found that
most students think that UK’s decision to
leave the EU will not affect the
commencement of GDPR. This finding is
favored by the opinion of Toh and Shariff
(2018), as it was evaluated that UK
government has ensured that decision of UK
to leave the EU will not impact the
commencement of GDPR. When an
individual is working in a UK organization
and it is handling the personal information
then it will have a need to comply with
GDPR regardless of the result of Brexit.
Through the data assessment, it can be
evaluated that most of the students stated
that the new set of rules of GDPR is simpler
and cheaper for business. This finding is
favored by the opinion of Bird and Dickons
(2018), as it was stated that GDPR is used to
give individuals more flexibility and the
right to be forgotten. It also permits an
individual who no longer desires their data
processed as long as there is no requirement
of maintaining it and then it would be
deleted. The unified EU data legislation of
GDPR should provide advantages to
businesses. The expectation is that GDPR
will make it cheaper and simpler for
businesses in order to deal within the region.
Through the data analysis, it is evaluated
that the company should provide training
regarding GDPR for more than a day. This
finding is supported by the opinion of Rossi
(2018), as it was determined that training
aids the company to understand general data
protection and get the potential
advantageous. By using this training
program, the company can better prepare for

RESEARCH 9
performing a discussion in around the new
regulation, adapt to the parameter and
understand the updated aspects,
backgrounds, terms, principles and
definition practiced in GDPR.
It is also found that most of the employers
believed younger than 15 years age of
people should learn regarding GDPR. This
finding is favoured by the view of Read
(2018), as it was determined that the GDPR
develops a single age limit of 16 after which
all children could be considered proficient to
consent to the dealing out with confidential
information unless national laws of member
state develops a lower age that cannot go
under the age of 13. It is evaluated that the
company is referring to GDPR and chances
for a member state to derogate from set age
of 16 in article 8 GDPR. The secretary of
state for privacy demonstrated that digital is
the new normal and that the age of 13 for the
consent of children with respect to
information society services. It corresponds
to the realism of the internet used by
children [8].
From the data assessment, it is addressed
that most of the respondents stated that they
have a contingency plan to be implemented
in case of a data breach. It is also addressed
that the company keeps data for 6 years or
less. This finding is favored by the opinion
of Chaudhuri (2016), as it was stated that the
contingency plan makes sure that a company
has a contingency plan in case of data
breaches. This plan emphasizes a different
sort of breaches that can occur and how to
deal with them. For instance, when a data
breach due to data theft then, contracting
with an individual is essential. Contingency
plan makes sure the guideline to follow
damaging events like data breach. The
company can also ensure that the plan of
action is in compliance with GDPR.
Conclusion
From the above discussion, general data
protection regulation can be used by the
company to protect the data. In addition,
both primary and secondary data collection
method would be used to gather the
information regarding research issues.
Furthermore, it can be summarised that the
company should have awareness regarding
the general data protection regulation. It is
evaluated that GDPR is an update on the
data protection act 1998 that indicates
personal data could be legally collected and
stored by companies that are certified in
accordance with the regulation of GDPR. It
can be summarised that the UK’s decision to
leave the EU will not affect the
commencement of GDPR. It can be
concluded that a new set of rules of GDPR
is simpler and cheaper for business. It can be
also concluded that the company should
provide training regarding GDPR for more
than a day. It can be concluded that
contingency plan to be implemented in case
of a data breach.

RESEARCH 10
References
[1]. Andersen, M.R., and Storm, H.H.,
2015. Cancer registration, public health and
the reform of the European data protection
framework: abandoning or improving
European public health research?. European
Journal of Cancer, 51, 9, 1028-1038.
[2]. Auffray, C., Balling, R., Barroso, I.,
Bencze, L., Benson, M., Bergeron, J.,
Bernal-Delgado, E., Blomberg, N., Bock, C.,
Conesa, A., and Del Signore, S., 2016.
Making sense of big data in health research:
towards an EU action plan. Genome
medicine, 8, 1, 71.
[3]. Bird, E. and Dickons, G., 2018. How
can practices prepare to comply with the
General Data Protection Regulation?.
Journal of Aesthetic Nursing, 7, 4, 222-222.
[4]. Chaudhuri, A., 2016. Internet of
things data protection and privacy in the era
of the General Data Protection Regulation.
Journal of Data Protection & Privacy, 1, 1,
64-75.
[5]. Crabtree, A., Lodge, T., Colley, J.,
Greenhalgh, C., Mortier, R., and Haddadi,
H. 2016. Enabling the new economic actor:
data protection, the digital economy, and the
Databox. Personal and Ubiquitous
Computing, 20, 6, 947-957.
[6]. Goddard, M., 2017. The EU General
Data Protection Regulation (GDPR):
European regulation that has a global
impact. International Journal of Market
Research, 59, 6, 703-705.
[7]. Kamleitner, B., Mitchell, V.,
Stephen, A. and Kolah, A., 2018. Customers
could be the weak link in consumer data
management systems. Journal of Data
Protection & Privacy, 2, 2, 171-176.
[8]. Kaye, J., Whitley, E.A., Lund, D.,
Morrison, M., Teare, H. and Melham, K.,
2015. Dynamic consent: a patient interface
for twenty-first-century research networks.
European Journal of Human Genetics, 23, 2,
p.141.
[9]. Ludvigsson, J.F., Almqvist, C.,
Bonamy, A.K.E., Ljung, R., Michaëlsson,
K., Neovius, M., Stephansson, O. and Ye,
W., 2016. Registers of the Swedish total
population and their use in medical research.
European journal of epidemiology, 31, 2,
125-136.
[10]. Read, C., 2018. What the new data
protection regulation means for veterinary
practices. In Practice, 40, 2, 75-77.
[11]. Rossi, A., 2018. How the Snowden
Revelations Saved the EU General Data
Protection Regulation. The International
Spectator, 53, 4, 95-111.
[12]. Scotti, L., Rea, F. and Corrao, G.,
2018. One-stage and two-stage meta-
analysis of individual participant data led to
consistent summarized evidence: lessons
learned from combining multiple databases.
Journal of clinical epidemiology, 95, 19-27.
[13]. Toh, V.V. and Shariff, Z., 2018. The
Ethical Considerations Of Mobile Medical
Photography For Skin Cancer Surgery After
The General Data Protection Regulation.
European Journal of Surgical Oncology, 44,
11, pp.1833-1834.
[14]. Wachter, S., Mittelstadt, B. and
Floridi, L., 2017. Why a right to an
explanation of automated decision-making
does not exist in the general data protection
regulation. International Data Privacy Law,
7, 2, 76-99.