Computing Legislation: The Four Acts You Must Know (OCR A-Level CS 1.5.1)

Free Computing Legislation revision resources (OCR A-Level Computer Science, 1.5.1)

We’ve made exam-style practice for this exact topic, free to download: Computing Legislation question sheet, mark scheme and cheat sheet. Grab them, have a go, then read the full guide below.

Computing doesn't happen in a legal vacuum. Spec point 1.5.1 covers four key pieces of UK legislation: the Data Protection Act, the Computer Misuse Act, the Copyright, Designs and Patents Act, and the Regulation of Investigatory Powers Act (RIPA). Exam questions ask you to name the relevant Act for a scenario, state its principles, or describe the offences it creates — so you need each Act's name, year, and purpose locked in.

Let's take the four in turn.

The Data Protection Act

The Data Protection Act governs how organisations may store and use personal data about living people. (The 1998 Act is the one named in the OCR spec; it has since been updated by the Data Protection Act 2018 alongside GDPR — worth a mention, but the principles are what's tested.)

It sets out principles that data must follow — data must be:

• processed lawfully and fairly,

• collected for specified, legitimate purposes only,

• adequate, relevant and not excessive,

• accurate and kept up to date,

• not kept longer than necessary,

• kept secure against loss or unauthorised access,

• (and not transferred outside protected regions without adequate protection).

It also gives individuals the right to see the data held about them (a subject access request). For the exam: if a scenario involves a company storing customers' or employees' personal details, the Data Protection Act is the relevant law, and the answer usually involves keeping data secure, accurate and used only for its stated purpose.

The Computer Misuse Act

The Computer Misuse Act 1990 makes unauthorised access to computer systems a criminal offence. It targets hacking and related activity, with three main offences:

• Unauthorised access to computer material (e.g. logging into an account you have no right to).

• Unauthorised access with intent to commit a further crime (e.g. accessing a system to steal money).

• Unauthorised modification of computer material (e.g. deleting or altering data, or introducing a virus).

A later amendment also made it an offence to make, supply or obtain tools (such as password crackers or keyloggers) for use in unauthorised access. For the exam: hacking, spreading malware or accessing accounts without permission all fall under the Computer Misuse Act.

The Copyright, Designs and Patents Act

The Copyright, Designs and Patents Act 1988 protects intellectual property — the original creative work of individuals and companies. It covers software, music, video, images, books and designs, giving the creator the exclusive right to copy, distribute or adapt their work.

So copying software without a licence, pirating music or film, or using someone's images without permission all infringe copyright. For the exam: if a scenario involves using or reproducing someone else's creative work (code, music, images), the Copyright, Designs and Patents Act applies, and good practice is to create your own, get a licence, or use material that is licensed for reuse.

The Regulation of Investigatory Powers Act (RIPA)

The Regulation of Investigatory Powers Act 2000 (RIPA) governs how public bodies — including the police and security services — may monitor and intercept communications during investigations. Among other powers, it can require:

• Internet Service Providers (ISPs) to provide access to a customer's communications, often in secret,

• ISPs to fit equipment to enable surveillance,

• someone to hand over encryption keys to access protected information.

RIPA is the Act behind lawful surveillance and interception. For the exam: scenarios about government or police monitoring of internet/phone communications point to RIPA, and it's the usual subject of "discuss whether mass surveillance is justified" essay questions.

Worked example: matching the law to the scenario

A games developer reuses commercial music and licensed code tools in her game, stores players' personal details, and worries about hackers. Three different Acts apply: the Copyright, Designs and Patents Act (the music and code are others' intellectual property — she needs licences); the Data Protection Act (the players' personal details must be kept secure and used only as stated); and the Computer Misuse Act (anyone hacking her system commits an offence under it). Spotting which Act fits which concern is exactly what the exam rewards.

Common exam mistakes

• Mixing up the Acts. Personal data → Data Protection; hacking → Computer Misuse; copying creative work → Copyright; surveillance → RIPA.

• Forgetting the year. Naming the Act and its year (1990, 1988, 2000) earns full marks.

• Vague Data Protection answers. Quote a principle — secure, accurate, used only for its stated purpose, not kept too long.

• Confusing the Computer Misuse offences. There are levels: access, access with intent, and modification.

• Calling everything "illegal". Name the specific Act and the offence/right it creates.

Quick recap

• Data Protection Act (1998 / 2018): governs personal data — must be secure, accurate, used only for its stated purpose; gives a subject access request.

• Computer Misuse Act 1990: criminalises unauthorised access, access with intent, and modification of computer material (hacking, malware).

• Copyright, Designs and Patents Act 1988: protects intellectual property — software, music, images; copying without a licence infringes it.

• RIPA 2000: governs lawful surveillance and interception of communications by public bodies (ISP access, encryption keys).

• Match the scenario to the right Act — and quote its year.

Frequently asked questions

What does the Data Protection Act cover? The Data Protection Act governs how organisations store and use personal data about living individuals. It requires data to be processed lawfully and fairly, kept accurate, secure and only as long as necessary, and used only for its specified purpose, and it gives individuals the right to request the data held about them.

What is the Computer Misuse Act? The Computer Misuse Act 1990 makes unauthorised access to computer systems a criminal offence. Its three main offences are unauthorised access to computer material, unauthorised access with intent to commit a further offence, and unauthorised modification of computer material, such as deleting data or introducing a virus.

What does the Copyright, Designs and Patents Act protect? The Copyright, Designs and Patents Act 1988 protects intellectual property — the original creative work of people and companies, including software, music, video, images and designs. It gives the creator the exclusive right to copy, distribute and adapt their work, so copying without a licence is infringement.

What is RIPA? The Regulation of Investigatory Powers Act 2000 governs how public bodies such as the police and security services may monitor and intercept communications during investigations. It can require internet service providers to give access to communications, to fit surveillance equipment, and require people to hand over encryption keys.

Which law applies if a company stores customers' personal data? The Data Protection Act applies. The company must keep the personal data secure, accurate and up to date, use it only for the purpose it was collected for, not keep it longer than necessary, and allow individuals to see the data held about them.

Which law is broken by hacking into a computer system? Hacking breaks the Computer Misuse Act 1990, which makes unauthorised access to computer material a criminal offence. If the access is gained in order to commit a further crime, or data is altered or deleted, more serious offences under the same Act apply.