Organisations collect and store personal data about their customers.

Mark scheme

Marking points from the official mark scheme. The mark or mark type is shown in brackets.

1. (a) B1 for each of two valid principles (e.g., 'Processed lawfully, fairly and transparently', 'Collected for specified, explicit and legitimate purposes', 'Adequate, relevant and limited to what is necessary', 'Accurate and, where necessary, kept up to date', 'Kept in a form which permits identification of data subjects for no longer than is necessary', 'Processed in a manner that ensures appropriate security of the personal data').
2. (b) B1 for stating a valid reason related to security (e.g., 'To protect data from unauthorised access', 'To ensure confidentiality of data', 'To prevent data breaches').
3. B1 for explaining *how* encryption achieves this (e.g., 'Encryption scrambles the data, making it unreadable without the correct decryption key', 'If data is stolen, it cannot be understood by unauthorised parties without the key').