AAT Level 2 Business Environment Practice Test

Confidentiality is about keeping information secret and sharing it only with people who are authorised to see it. Data protection is the legal framework that governs how personal data is collected, stored, used, shared, and safeguarded, including the rights of individuals and the responsibilities of organisations. Because data protection sets out broad rules and duties beyond simply keeping information secret, it’s much more than encryption or any single security measure. It covers things like lawful bases for processing, purpose limitation, data retention, breach notifications, and accountability, as well as the roles of data controllers and processors. So the statement that confidentiality restricts information to authorised people while data protection provides the legal framework for handling personal data best captures the difference.