IT risks, UK computer law and ISO 31000 risk management
In short: Every type of device brings its own risks. In the UK, personal data is governed by the UK GDPR and the Data Protection Act 2018 (which replaced the 1998 Act), and the Computer Misuse Act 1990 makes unauthorised access a crime. ISO 31000 gives a framework for managing these risks consistently.
Risks by type of technology
| Area | Typical risks |
|---|---|
| Hardware | Failure, theft, tampering, end-of-life equipment with no more updates |
| Software | Unpatched vulnerabilities, unlicensed or pirated copies, misconfiguration |
| Mobile devices | Loss and theft, unsafe apps, public Wi-Fi, mixing personal and work data |
| IoT devices | Default passwords, rare updates, weak encryption, used as entry points or botnet members |
Intellectual property
- Copyright: protects original works such as software code, documents, images and music automatically once created. Copying or distributing without permission is infringement.
- Patents: protect new inventions, granted on application for a limited time (normally up to 20 years in the UK).
- Trade marks protect brand names and logos; licences set the terms for using software.
Data protection in the UK
The Data Protection Act 1998 has been replaced. Personal data in the UK is now governed by the UK GDPR together with the Data Protection Act 2018. Their principles say personal data must be:
- Processed lawfully, fairly and transparently.
- Collected for specified, legitimate purposes only.
- Adequate, relevant and limited to what is needed.
- Accurate and kept up to date.
- Kept no longer than necessary.
- Kept secure (integrity and confidentiality).
The organisation must also be able to demonstrate compliance (accountability) and must report serious personal data breaches to the Information Commissioner’s Office within 72 hours.
The Computer Misuse Act 1990
- Section 1: unauthorised access to computer material, for example logging in with someone else’s password.
- Section 2: unauthorised access with intent to commit or help commit a further offence such as fraud.
- Section 3: unauthorised acts that impair a computer, for example spreading malware or a DoS attack.
- Section 3ZA: unauthorised acts causing, or risking, serious damage such as to national infrastructure.
- Section 3A: making, supplying or obtaining tools intended for these offences.
For network engineers: always have written permission before scanning or testing systems, even your employer’s.
ISO 31000 risk management
ISO 31000 is an international standard giving guidance (not certification) for managing any kind of risk. Its principles say risk management should be integrated into the organisation, structured and comprehensive, customised, inclusive, dynamic, based on the best available information, aware of human and cultural factors, and continually improved.
Treating risk
| Option | Meaning | Example |
|---|---|---|
| Avoid | Stop the activity that causes the risk | Retire an insecure legacy service |
| Reduce | Lower likelihood or impact with controls | Add MFA, patching, a firewall |
| Share (transfer) | Pass part of the risk to another party | Cyber insurance, outsourcing to a provider |
| Accept | Knowingly keep the risk | A low-impact risk where controls cost more than the loss |
Practice
Which UK laws now replace the Data Protection Act 1998?
A student guesses a teacher’s password and reads their email. Which section of the Computer Misuse Act applies?
Buying cyber insurance is which risk treatment option?
Key takeaways
- Hardware, software, mobile and IoT devices each bring distinct risks.
- Copyright is automatic; patents must be applied for.
- UK GDPR and DPA 2018 replaced the DPA 1998.
- The Computer Misuse Act 1990 criminalises unauthorised access and impairment.
- ISO 31000: set context, assess, treat, while communicating and monitoring.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.