Data Privacy and Data Security

Hello students, welcome to Kwickprep. You fill a form for a free game, and a week later strangers call you with offers. How did they get your number? Today we will learn data privacy and data security, how data breaches happen, and how to protect personal data, including in AI projects.

First, what are we protecting? Personal data is any information that can identify a person. Your name, phone number, home address, photo and Aadhaar number are personal data. Your marks, your live location, your health records and your bank details are personal data too.

Privacy and security are related, but they are not the same. Data privacy asks, who is allowed to collect and use my data, while data security asks, is the data protected from attack? Privacy is about rights and consent, and security is about locks and defences. An app asking your permission is privacy, while a password and an OTP are security. A company secretly selling your data breaks privacy, and a hacker stealing it breaks security.

Here is why you need both. A company can guard data very well, yet still misuse it without asking you. Another company can have fair rules, but weak passwords, so hackers steal the data anyway. Think of a bank locker, where the lock is security and the rule that only you may open it is privacy.

Now a new term. A data breach happens when data is seen, copied or stolen by someone who has no permission. A breach can leak names, passwords, card numbers or health records of millions of people. Leaked data is often sold online and used for scams and fraud.

Most breaches happen in a few common ways. Phishing uses a fake message or call to trick you into giving details, like a fake bank SMS asking for your OTP. Weak passwords like one two three four five six are guessed in seconds. Malware is harmful software, often hidden inside cracked apps or unknown downloads. Human error happens when someone sends a file to the wrong person. And unsafe storage means a database is left online with no password at all.

Let us see how to handle a phishing message. You get an SMS saying your KYC has expired, with a link to click. Ask, did this really come from my bank's official number? If you are sure it did, still open the official app yourself instead of the link. If not, do not click, and report it, for example on the national cyber crime helpline, one nine three zero.

So how can you protect your personal data? Use strong passwords that are different for each account, and switch on two step verification. Never share an OTP, PIN or password, not even with someone claiming to be from the bank. Give apps only the permissions they really need, so a torch app does not need your contacts. Keep your phone and apps updated, because updates fix security holes. And think before posting photos, school names or live location online.

Pause and predict. A quiz app asks for your contacts, camera and location. Which of these does it actually need to show quiz questions? The answer is none, so you should deny all three.

India also protects personal data by law. The law is called the Digital Personal Data Protection Act, passed in two thousand twenty three. It says personal data can be used only with clear consent, and only for the stated purpose. People have the right to ask for their data to be corrected or erased. Companies must keep data safe, and must report breaches when they happen.

When you build an AI project, even in school, follow these best practices. Collect only the data that the project truly needs, which is called data minimisation. Get consent from people, and tell them why you are collecting their data. Anonymise the data, which means removing names, phone numbers and IDs, so nobody can be identified. Store it securely, with passwords and access only for team members. Finally, delete the data once the project is finished.

Let us apply this to a school project, an AI that predicts canteen food demand. Collecting names and phone numbers is bad, because class and food choice are enough. Collecting without asking is bad, so the form must explain the purpose and ask for consent. A public spreadsheet is unsafe, so keep it locked and shared only with the team. And do not keep the data forever, delete it when the project ends.

Let us revise what we learned today. Privacy is about who may use data, and security is about keeping it safe. Breaches happen through phishing, weak passwords, malware and human error. Protect your data with strong passwords, and never share your OTP. In India, the Digital Personal Data Protection Act of two thousand twenty three protects personal data. And in AI projects, minimise, get consent, anonymise, secure and delete. Check the permissions on your own phone today.