A legal answer needs a relevant rule and a clear connection to the facts. Learn the four laws named by OCR, while distinguishing historical specification wording from today's framework.
Content owner: Michael Print · Written for A-Level learners · Checked against official specifications
The idea to start with
Data protection concerns processing personal data; computer misuse concerns unauthorised access and acts; copyright protects eligible original works; investigatory powers govern specified surveillance techniques and their authorisation.
OCR 1.5.1 names the Data Protection Act 1998. For current UK context, use the UK GDPR and Data Protection Act 2018, as amended. Keep the syllabus reference and current law distinct. Sources below were checked on 10 October 2026.
OCR H446 · 1.5.1(a–d)
Before you start
Useful foundations
Personal data can identify a living person directly or indirectly.
Access permissions define which programs and data a user may use.
By the end, you should be able to
Distinguish the purpose of the four named statutes.
Apply a rule to an original scenario and identify missing facts.
Explain the historical DPA 1998 reference without describing it as current law.
Data protection: what is needed, and why?
A booking service needs a name and contact details to arrange an appointment. That does not automatically justify recording every customer's browsing history. Ask what personal data is collected, why it is needed, who can see it and when it will be removed.
The current principles cover lawful, fair and transparent processing; specified purposes; minimisation; accuracy; storage limitation; security; and accountability. Consent is one possible lawful basis, rather than a requirement for every kind of processing. Rights such as access and correction have conditions and exceptions.
DPA 1998: recognise the historical syllabus list
The OCR question may name the 1998 Act. Its eight historical principles are listed below. The modern framework has changed: do not treat the historical and current lists as identical.
Fair and lawful processing.
Specified purposes.
Adequate, relevant and non-excessive data.
Accuracy.
Retention only as long as necessary.
Data-subject rights.
Security.
Restrictions on overseas transfers without adequate protection.
Computer Misuse Act 1990: permission matters
Section 1 concerns intentional access to computer material when the person knows the intended access is unauthorised. Section 2 adds intent to commit or facilitate a further qualifying offence. Section 3 concerns knowing unauthorised acts with intent, or recklessness, about impairing operation or access.
The CPS reference explains the precise elements.
Knowing a password does not establish permission. Conversely, describing any unwanted computer behaviour as a Computer Misuse Act offence is too broad. Establish the access boundary and the person's knowledge or intention.
An approved security test stays within its written scope; an account for one service does not grant unrestricted access to others.
Copyright, Designs and Patents Act 1988
Copyright can protect original software, images, text and recordings. Availability on a website does not itself grant permission to copy or redistribute a work. A licence may permit specific uses with conditions; applicable exceptions must be considered.
For a school app, distinguish the author's own source code from a downloaded photograph and a third-party library. Record the origin and licence of each. Giving credit and having permission are separate questions. An open-source licence can allow reuse while still imposing conditions.
Regulation of Investigatory Powers Act 2000
RIPA provides an authorisation framework for specified covert techniques used by public authorities, including covert surveillance. Discuss necessity, proportionality and safeguards rather than claiming that any authority may monitor anyone for any reason.
The current investigatory framework also includes the Investigatory Powers Act 2016 and subsequent amendments. RIPA remains relevant to covert surveillance; some communications powers are now addressed by the newer framework. OCR's named-law question is an introduction, rather than a complete guide to every current power.
Build a scenario answer
Separate a plausible legal issue from a definite finding. A six-mark answer should develop several connected applications, rather than list six law names.
Fact → relevant rule → consequence
1
Identify the fact
What happened? For example, an image was copied or restricted data was opened.
2
Connect a relevant rule
Which law concerns this action, and which conditions need checking?
3
Explain the consequence
Apply that rule to the stated facts instead of merely naming it.
4
State missing information
A data request does not reveal its lawful basis; a copied file does not reveal its licence. Explain uncertainty rather than assume a breach.
Worked example
A volunteer's appointment spreadsheet
A charity gives a volunteer access to appointment times, but explicitly denies access to medical notes. The volunteer deliberately opens the restricted notes using another person's account.
The access boundary and deliberate conduct raise an unauthorised-access issue under the Computer Misuse Act. The knowledge of the restriction is a relevant fact.
Sending the notes to a marketing company also raises data-protection questions about lawful processing, purpose and security. The data's sensitivity makes careful handling especially important.
Do not infer that every marketing transfer is unlawful in every situation. Identify the facts that support this scenario's concern and the further information needed to assess it.
Worked example
An investigation and a copied image
A public authority proposes covertly observing a person's movements in a specific investigation. Identify the proposed technique and private information being obtained before discussing whether the relevant RIPA authorisation conditions are met.
A worthwhile investigative aim is not itself the authorisation. Consider necessity, proportionality and the relevant safeguards, including incidental collection about other people.
Separately, its information campaign copies a photographer's image from a public website. Identify copyright and check the permitted use under a licence, permission or applicable exception.
Credit identifies a creator but does not itself establish permission. These two activities raise distinct questions: lawful investigatory authority and rights to reuse the image.
Original A-Level practice
4 original questions total 14 marks. Attempt each before opening the independently written indicative marking guidance.
Question 1
4 marks
A club asks for members' names, addresses and unrelated relatives' medical histories to issue membership cards. Explain two data-protection concerns. [4]
Show solution and marking guidance+
Indicative answer
Medical histories of unrelated relatives do not appear necessary for issuing a card; connect this to minimisation (1+1).
The club must explain its purposes and establish lawful processing, rather than treat card membership as blanket permission; connect the concern to the scenario (1+1). Credit another accurately applied principle.
Question 2
3 marks
A developer deliberately uses a colleague's credentials to open a folder they know they are forbidden to access. No data is changed. Explain why computer misuse may still be relevant. [3]
Show solution and marking guidance+
Indicative answer
Intentional access is involved (1).
They know the intended access is unauthorised (1).
Section 1 does not require modifying or deleting data; the access itself can be the issue (1).
Question 3
3 marks
Explain why adding an image credit does not necessarily permit including a downloaded photograph in a commercial app. [3]
Show solution and marking guidance+
Indicative answer
Copyright may protect the photograph (1).
Attribution alone does not grant a licence or permission to copy/distribute it (1).
Check the actual licence, permission or applicable exception for this use (1).
Question 4
4 marks
Explain the purpose of RIPA in an answer about public-authority covert surveillance, and identify one limitation of a simple 'RIPA allows surveillance' claim. [4]
Show solution and marking guidance+
Indicative answer
It provides an authorisation framework for specified covert investigatory techniques (1).
Necessity/proportionality and safeguards must be considered (1).
It does not confer unrestricted permission on every authority or every activity (1).
Current communications powers also involve the Investigatory Powers Act 2016, so the named statute is not the whole present framework (1).
Specification and references
This guide addresses OCR H446 1.5.1(a–d). Check your examination year and the complete specification for the assessment scope.
These are independently written explanations and practice questions. CompSciTutoring.co.uk is not affiliated with or endorsed by an examination board. The marking guidance is indicative; always check the syllabus for your examination year.