Security measures to protect personal information

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A school stores student health records in a spreadsheet. Which measure best stops a stranger who finds the file from reading it?

A Encrypt the file so it is unreadable without the key

B Rename the file to something boring

2. A club's member database was lost when a laptop crashed. Which measure would have reduced the risk of losing the data?

A A longer password on the laptop

B Regular backups stored in a separate location

3. Which is a PHYSICAL security measure for protecting personal information?

A Keeping the server in a locked room

B Using multi-factor authentication to log in

4. Which is a DIGITAL security measure for protecting personal information?

A Fitting a security camera in the office

B Setting user permissions so only the payroll officer can edit pay data

5. Under APP 11, what must an organisation do with the personal information it holds?

A Take reasonable steps to protect it from misuse, interference, loss and unauthorised access

B Publish it so people can check it is correct

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Encryption		AThe password is weak and shared, so anyone could guess or see it. Use strong, unique passwords for each user and keep them private.
2Access control		BLocked server room with swipe card entry
3A physical measure that protects personal information stored on a computer		CAntivirus does not fix the risk of theft. A better match is encryption or a physical lock, because the risk is lost or stolen devices.
4A digital measure that lets an organisation recover personal information after loss or damage		DLimits who can view or change a dataset by giving users permissions based on their role
5A student database is protected with the password 'password123', shared by all staff on a sticky note		EScrambles data into unreadable code so it cannot be understood if it is stolen or intercepted without the key
6To stop someone stealing a laptop with customer data, the company installs antivirus software only		FDaily backup stored on a separate secure drive

Definitions

security measures

Fill in the Blanks

Complete each line of code by filling in the missing parts.

RISK: laptop with the dataset is stolen MEASURE: __________

RISK: staff open files they don't need MEASURE: ______________

RISK: hard drive fails and data is lost MEASURE: regular _______

PHYSICAL MEASURE: ______ server room

APP 11: take __________ steps to protect personal information

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A SET min_length TO 12

B IF length(pw) > min_length

C THEN REJECT password

D ELSE ACCEPT password

Question 2

A ROLE doctor CAN write records

B ROLE clerk CAN delete all

C ROLE visitor CAN read nothing

Question 3

A SET file TO patients.csv

B DECRYPT file USING key

C STORE file ON server

Question 4

A EVERY night AT 2am

B COPY database TO backup

C STORE backup ON same disk

Question 5

A ASK username AND password

B SEND code TO user phone

C IF password OK THEN ALLOW

Answer Key

Security measures to protect personal information

Section A: Quick Questions

A — Encrypt the file so it is unreadable without the key

B — Regular backups stored in a separate location

A — Keeping the server in a locked room

B — Setting user permissions so only the payroll officer can edit pay data

A — Take reasonable steps to protect it from misuse, interference, loss and unauthorised access

Section B: Match the Pairs

Encryption → Scrambles data into unreadable code so it cannot be understood if it is stolen or intercepted without the key

Access control → Limits who can view or change a dataset by giving users permissions based on their role

A physical measure that protects personal information stored on a computer → Locked server room with swipe card entry

A digital measure that lets an organisation recover personal information after loss or damage → Daily backup stored on a separate secure drive

A student database is protected with the password 'password123', shared by all staff on a sticky note → The password is weak and shared, so anyone could guess or see it. Use strong, unique passwords for each user and keep them private.

To stop someone stealing a laptop with customer data, the company installs antivirus software only → Antivirus does not fix the risk of theft. A better match is encryption or a physical lock, because the risk is lost or stolen devices.

Section C: Definitions

security measures — Controls such as passwords, access control, encryption and backups that protect personal information in a dataset from misuse, loss or unauthorised access.

Section D: Fill in the Blanks

RISK: laptop with the dataset is stolen
MEASURE: encryption

RISK: staff open files they don't need
MEASURE: access control

RISK: hard drive fails and data is lost
MEASURE: regular backups

PHYSICAL MEASURE: locked server room

APP 11: take reasonable steps to
protect personal information

Section E: Spot the Error

B — The check is reversed. A password rule should reject passwords that are too short, so it must use < min_length, not >. As written it would reject long, stronger passwords.

B — Access control should follow least privilege. A clerk only needs to read contact details, so giving them the right to delete everything puts personal information at risk. It should be ROLE clerk CAN read contact.

B — The file must be encrypted before it is stored so it is unreadable if stolen. DECRYPT turns it back into readable text, so the line should be ENCRYPT file USING key.

C — A backup kept on the same disk is lost if that disk fails or is stolen. It should be stored in a separate, secure location, such as offsite or in the cloud: STORE backup OFFSITE.

C — Multi-factor authentication needs a second factor. Access must depend on the code sent to the phone matching, not just the password. It should be IF code matches THEN ALLOW.