Skip to content

ACCA Applied Knowledge · Business and Technology · Financial systems and technology

An employee of Karo Co copies a customer database to a personal device and sells it to a competitor. Which statement best identifies the main data protection principle breached?

The breach is of the principles that personal data must be processed securely and only for the purposes for which it was collected. Selling the database to a competitor is unauthorised use and shows a failure of security, whereas indefinite retention and disclosure to any third party are not data protection requirements.

  1. APersonal data must be processed securely and only for the purposes for which it was collectedCorrect
  2. BPersonal data must be kept indefinitely to allow future audit
  3. CPersonal data must be published to customers on request by any third party

Explanation

Data protection principles require personal data to be used only for specified, legitimate purposes and protected against unauthorised processing. Selling it breaches purpose limitation and security. Indefinite retention and disclosure to any third party are not principles; storage limitation actually requires the opposite of the first of those.

Did you get it right without looking?

One question tells you little. A timed set on Financial systems and technology shows your real accuracy, how long you take and where you lose marks.

Practise Financial systems and technologyFree diagnostic mock

More Financial systems and technology questions