← VCE Data Analysis

Security measures to protect personal information

Controls such as passwords, access control, encryption and backups that protect personal information in a dataset from misuse, loss or unauthorised access.

Part of: VCE Applied Computing - U1O1 - Data analysis — Module 47, VCE Software Development - U3O2 - Analysis and Design — Module 108, VCE Data Analytics - U4O1 - Development and Evaluation — Module 41, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 59, ACARA Digital Technologies Years 9–10 — Privacy Principles and Digital Footprints — Module 45, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 47, WA Computer Science ATAR Year 11 — Data Management — Module 105, WA Computer Science ATAR Year 11 — Cyber Security — Module 157

Understanding Security measures to protect personal information in VCE Data Analysis

What it does: Locking the room where devices are kept stops unauthorised people physically reaching the data. Backups protect against loss, for example from hardware failure or ransomware, so the data can be restored. Encryption scrambles data so that, even if someone gets the file, they cannot read it without the key. Renaming a file hides nothing. Physical measures control access to hardware and paper, such as locked rooms. Multi-factor authentication is a digital measure. APP 11 is about security of personal information. It requires reasonable steps to protect it, and also to destroy or de-identify it when it is no longer needed.

Common mistakes: The check is reversed. A password rule should reject passwords that are too short, so it must use < min_length, not >. As written it would reject long, stronger passwords. Access control should follow least privilege. A clerk only needs to read contact details, so giving them the right to delete everything puts personal information at risk. It should be ROLE clerk CAN read contact.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Security measures to protect personal information to a class →

This module's key terms are also in a printable crossword (Modules 38–54) and word search (Modules 25–54).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A school stores student health records in a spreadsheet. Which measure best stops a stranger who finds the file from reading it?
Encrypt the file so it is unreadable without the keyRename the file to something boring
Matches
A student database is protected with the password 'password123', shared by all staff on a sticky note
↓
The password is weak and shared, so anyone could guess or see it. Use strong, unique passwords for each user and keep them private.
Applying
Meanings
Term
security measures
Meaning
Controls such as passwords, access control, encryption and backups that protect personal information in a dataset from misuse, loss or unauthorised access.
Practice
Risk: weak login -> Measure: strong password
Testing
Gaps
MEASURE:
Check Answer
Spots
1SET min_length TO 12
2IF length(pw) > min_length

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Clownfish' badge — Reef Rookie, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A school stores student health records in a spreadsheet. Which measure best stops a stranger who finds the file from reading it?
A. Encrypt the file so it is unreadable without the key ✓
B. Rename the file to something boring
Encryption scrambles data so that, even if someone gets the file, they cannot read it without the key. Renaming a file hides nothing.
2. A club's member database was lost when a laptop crashed. Which measure would have reduced the risk of losing the data?
A. A longer password on the laptop
B. Regular backups stored in a separate location ✓
Backups protect against loss. A strong password protects against unauthorised access, but it will not bring back data after a crash.
3. Which is a PHYSICAL security measure for protecting personal information?
A. Keeping the server in a locked room ✓
B. Using multi-factor authentication to log in
Physical measures control access to hardware and paper, such as locked rooms. Multi-factor authentication is a digital measure.
4. Which is a DIGITAL security measure for protecting personal information?
A. Fitting a security camera in the office
B. Setting user permissions so only the payroll officer can edit pay data ✓
User permissions are access control in software, so they are digital. A security camera is a physical measure.
5. Under APP 11, what must an organisation do with the personal information it holds?
A. Take reasonable steps to protect it from misuse, interference, loss and unauthorised access ✓
B. Publish it so people can check it is correct
APP 11 is about security of personal information. It requires reasonable steps to protect it, and also to destroy or de-identify it when it is no longer needed.

Match the Pairs

Encryption → Scrambles data into unreadable code so it cannot be understood if it is stolen or intercepted without the key
Access control → Limits who can view or change a dataset by giving users permissions based on their role
A physical measure that protects personal information stored on a computer → Locked server room with swipe card entry
A digital measure that lets an organisation recover personal information after loss or damage → Daily backup stored on a separate secure drive
A student database is protected with the password 'password123', shared by all staff on a sticky note → The password is weak and shared, so anyone could guess or see it. Use strong, unique passwords for each user and keep them private.
To stop someone stealing a laptop with customer data, the company installs antivirus software only → Antivirus does not fix the risk of theft. A better match is encryption or a physical lock, because the risk is lost or stolen devices.

Key Term

security measures
Controls such as passwords, access control, encryption and backups that protect personal information in a dataset from misuse, loss or unauthorised access.

Fill in the Blanks

1. RISK: laptop with the dataset is stolen MEASURE: encryption
Hint: Type the measure that scrambles data so a thief cannot read it without a key.
2. RISK: staff open files they don't need MEASURE: access control
Hint: Type the measure that limits who can view or edit data based on their role.
3. RISK: hard drive fails and data is lost MEASURE: regular backups
Hint: Type the measure that keeps extra copies of data so it can be restored after loss.
4. PHYSICAL MEASURE: locked server room
Hint: Type the word describing a server room door that only key or swipe card holders can open.
5. APP 11: take reasonable steps to protect personal information
Hint: Type the word that describes the level of steps APP 11 requires an organisation to take.

Spot the Error

Question 1
A SET min_length TO 12
B IF length(pw) > min_length
C THEN REJECT password
D ELSE ACCEPT password
Line B — The check is reversed. A password rule should reject passwords that are too short, so it must use < min_length, not >. As written it would reject long, stronger passwords.
Question 2
A ROLE doctor CAN write records
B ROLE clerk CAN delete all
C ROLE visitor CAN read nothing
Line B — Access control should follow least privilege. A clerk only needs to read contact details, so giving them the right to delete everything puts personal information at risk. It should be ROLE clerk CAN read contact.
Question 3
A SET file TO patients.csv
B DECRYPT file USING key
C STORE file ON server
Line B — The file must be encrypted before it is stored so it is unreadable if stolen. DECRYPT turns it back into readable text, so the line should be ENCRYPT file USING key.
Question 4
A EVERY night AT 2am
B COPY database TO backup
C STORE backup ON same disk
Line C — A backup kept on the same disk is lost if that disk fails or is stolen. It should be stored in a separate, secure location, such as offsite or in the cloud: STORE backup OFFSITE.
Question 5
A ASK username AND password
B SEND code TO user phone
C IF password OK THEN ALLOW
Line C — Multi-factor authentication needs a second factor. Access must depend on the code sent to the phone matching, not just the password. It should be IF code matches THEN ALLOW.

Student with a class code? Join your class →