What is Data Protection?

What is data protection?

Data protection is the set of legal rules, technical controls and working habits that keep personal data collected, used, stored and deleted in a lawful, limited and secure way. It is about people: what an organisation may do with information about them, and how it must look after it. This page is general background, not legal advice.

How data protection works

It rests on three layers that depend on each other. Rules set what is allowed, such as the EU's GDPR. Technical controls make the rules enforceable: encryption, role-based access control, logging and database security. Organisational habits keep it going: knowing what data you hold, training staff, vetting vendors and having a breach plan.

The EDPB defines personal data as "any information relating to an identified or identifiable individual". That includes obvious items like names and emails, and anything that can identify someone indirectly.

The principles behind it

The EDPB's guide for small businesses lists six principles that most modern privacy laws echo:

• Lawfulness, fairness and transparency: a valid legal basis, and no surprises for the person.
• Purpose limitation: collect for specified, explicit and legitimate purposes only.
• Data minimisation: process only what is necessary and proportionate.
• Accuracy: keep data correct and up to date.
• Storage limitation: delete or anonymise data once it is no longer needed.
• Security: prevent accidental, unauthorised or unlawful disclosure, loss, destruction or damage.

Individual rights

Under the GDPR, people can ask to be informed, to access their data, to have it corrected or erased, to restrict or object to processing, to move it elsewhere (portability), and not to be subject to decisions based solely on automated processing. The EDPB says a controller must respond within one month of a request, with a possible extension for complex cases if the person is told in time.

A practical example

A SaaS team gets an erasure request. Deleting the user row is not enough: the same person's email may sit in backups, analytics exports, support tools and logs. Teams that handle this well keep a data inventory, know where each copy lives and have a tested deletion routine, instead of searching under pressure.

Common mistakes

• Treating it as a one-off audit. Data flows change every sprint, so inventories and policies need regular review.
• Collecting "just in case". Data you never collected cannot leak, and cannot be justified later.
• Forgetting copies. Backups, logs, test databases and third-party tools hold personal data too.
• Real data in test environments. Use masked or synthetic data in staging and load tests.
• Equating it with cybersecurity. Security guards against attackers; data protection also limits what the organisation itself does with data.
• Loose access. Apply least privilege through identity and access management.

Data protection, APIs and testing

Most personal data now moves through APIs, so API security is a large part of the job. Testing supports it in a small, practical way. LoadFocus API monitoring can check on a schedule that endpoints return the expected status codes and fields, including the ones behind access and deletion requests. Load testing shows whether those endpoints still respond under heavy traffic, and works best with synthetic data. These checks verify behaviour. LoadFocus is not a compliance tool and does not certify compliance with any law. For related security practice, see the cloud testing security guide.

FAQ: Data Protection

What is the difference between data protection and data privacy?

The terms overlap and are often used interchangeably. Privacy usually refers to people's expectations and rights over their information. Data protection is the practical side: the rules, controls and processes that uphold those rights, including security.

What counts as personal data?

Any information relating to an identified or identifiable individual, directly or indirectly. Names and emails are obvious, but so can be IP addresses, device identifiers and location data when they can be tied to a person.

Is data protection the same as data security?

No. Data security protects data from loss and unauthorised access. Data protection includes security but also covers lawful use, limiting what you collect, how long you keep it and the rights of the people concerned.

How long can personal data be kept?

Only as long as it is needed for the purpose it was collected for. Storage limitation means setting retention periods per type of data and deleting or anonymising on schedule.

Do I need a lawyer to get this right?

For legal questions about your situation, yes, ask a qualified professional or your data protection authority. This glossary only explains the concepts.