Legislation and Professional Standards

Why Does Computing Need Laws?

Technology moves faster than most people’s intuitions about right and wrong. Without legislation, individuals and organisations would have no clear boundaries for what is acceptable when handling personal data, accessing computer systems or copying digital content. UK law provides those boundaries through several key Acts of Parliament, each targeting a specific set of harms. You need to know the name, year, and purpose of each one.

Data Protection Act 2018 and UK GDPR

The Data Protection Act 2018 is the main UK law governing the handling of personal data. It works alongside the UK GDPR (General Data Protection Regulation), the European data protection rules that were kept in UK law after Brexit. Any organisation that collects or processes personal data about living individuals must comply.

The Act gives individuals a set of key rights:

The right of access — you can request a copy of all personal data an organisation holds about you (a “Subject Access Request”).
The right to erasure — the “right to be forgotten”; you can ask an organisation to delete your data in certain circumstances.
The right to rectification — you can demand that inaccurate data about you is corrected.
The right to data portability — you can ask for your data in a machine-readable format to move it to another provider.

Organisations must have a lawful basis for processing data — such as your explicit consent, a contractual necessity, or a legal obligation. Data must be kept accurate, stored securely, and not retained longer than necessary. The UK’s Information Commissioner’s Office (ICO) enforces the Act and can issue large fines for breaches.

Key Fact

The Data Protection Act 2018 / UK GDPR gives individuals four key rights: access (Subject Access Request), erasure (right to be forgotten), rectification (correct inaccurate data), and data portability. Organisations must have a lawful basis for any data processing.

Computer Misuse Act 1990

The Computer Misuse Act 1990 was introduced after two high-profile hacking cases revealed that UK law had no mechanism to prosecute people who accessed computer systems without permission. The Act created three principal offences:

Unauthorised access to computer material — hacking into a system you are not permitted to use, even if no data is taken. It can be punished by up to 2 years in prison.
Unauthorised access with intent to commit a further offence — hacking with the intention of committing fraud or blackmail. This carries a heavier penalty.
Unauthorised modification of computer material — changing, deleting or encrypting data without permission. This covers installing malware, ransomware, or deliberately corrupting files, and can carry up to 10 years in prison.

Copyright, Designs and Patents Act 1988

The Copyright, Designs and Patents Act 1988 protects creators’ intellectual property automatically from the moment a work is created — no registration is required. In computing, this means:

Copying or distributing software without a valid licence is illegal — this includes piracy of games, office software and creative tools.
Images, videos and music downloaded from the internet are typically protected — reusing them without permission or a licence is an infringement.
Code written by a developer is automatically their intellectual property (or their employer’s, if written during employment).

Creative Commons licences provide a legal framework for creators who want to share their work. Different Creative Commons licences allow different uses — for example, “Attribution” (CC BY) allows anyone to reuse the work as long as they credit the creator, while “Attribution-NonCommercial” (CC BY-NC) allows reuse only for non-commercial purposes. Understanding which licence applies before reusing an image or piece of code is a key professional skill.

The Regulation of Investigatory Powers Act 2000 (RIPA) sets out when and how government agencies — such as the police, intelligence services and local councils — may lawfully intercept communications, use covert surveillance, and access electronic data. Before RIPA, there was no unified legal framework governing these powers; they were exercised under a patchwork of older laws.

RIPA requires that surveillance activities are authorised, necessary, and proportionate. For example, police can request that an internet service provider (ISP) retain records of a suspect’s online activity if a proper authorisation is in place. Without that authorisation, accessing such records would be unlawful. RIPA was later supplemented by the Investigatory Powers Act 2016 (sometimes called the “Snoopers’ Charter”), which updated and extended the framework for bulk data collection and equipment interference by intelligence services.

The Freedom of Information Act 2000 (FOI Act) gives any person the right to request information held by public bodies — including government departments, local councils, NHS trusts and publicly funded schools. The public body must respond within 20 working days and either provide the information or explain why an exemption applies (for example, if disclosure would compromise national security or ongoing criminal investigations).

In computing terms, FOI requests are often used to obtain data about government IT contracts, software systems used in public services, or how personal data is managed. The Act promotes transparency and accountability, allowing journalists, researchers and ordinary citizens to scrutinise how public money and public power are being used.

Key Fact

Five key Acts and their years: Computer Misuse Act 1990, Copyright, Designs and Patents Act 1988, Data Protection Act 2018 (UK GDPR), Regulation of Investigatory Powers Act 2000 (RIPA), Freedom of Information Act 2000.

Professional Standards and Codes of Conduct

Laws set the minimum standard of behaviour. Professional standards go further — they describe what good practice looks like, even when the law does not require it. The British Computer Society (BCS) is the professional body for computing in the UK. Its Code of Conduct requires members to:

Act in the public interest — considering the broader impact of their work on society, not just the interests of their employer or client.
Maintain professional competence — keeping skills and knowledge up to date, and only taking on work they are qualified to do.
Act with integrity — being honest, avoiding conflicts of interest, and reporting concerns about unethical or dangerous software.
Respect the organisation and individuals — protecting confidential information, respecting colleagues, and not discriminating.

Codes of conduct like the BCS Code matter because computing professionals often work with sensitive data and critical infrastructure. A programmer who discovers that their employer’s software contains a serious security flaw has a professional obligation to raise the issue, even if doing so is inconvenient or commercially damaging. Professional codes provide a framework for making these ethical decisions — and, where the code is backed by a professional body, members who breach it can face disciplinary action including loss of membership.