D828 Legal Issues in Information Security carries banner number ITAS 3011 and is worth 4 competency units. It covers cybersecurity laws and the ethical questions around them, why compliance matters to an organization, and the standards and frameworks that govern the protection of data privacy. D828 and ITAS 3011 are one requirement. It is the course that teaches security practitioners to recognise when a technical decision has become a legal one.
Compliance, law and ethics are three different tests
The distinction that organises this whole course is between what is legally required, what a standard or contract obliges, and what is right. They overlap and they are not the same. An action can be lawful and unethical. A practice can satisfy a framework and still breach a specific statutory duty. A control can be ethically desirable and legally impossible in one jurisdiction. Aspects in this course frequently ask you to apply one of those three tests, and answers that blur them lose credit even when the conclusion is reasonable.
Jurisdiction is the second organising idea and the one students most often ignore. Data protection obligations follow the data and the people it describes, not the building the server sits in. A cloud service, a remote worker or an overseas customer can pull an organization into obligations it did not choose. When a scenario mentions where customers live, where staff work or where data is stored, those details are not colour; they determine which rules apply.
Privacy frameworks then give you the working vocabulary: what counts as personal data, what a lawful basis is, what rights individuals hold, what retention limits mean, and what obligations arise when something goes wrong. This is a subject where precision pays. Personal data is a defined term, not a general idea, and getting its boundary right determines whether an obligation exists at all.
Ethics deserves genuine attention rather than a closing paragraph. Security work involves monitoring people, holding information about them and occasionally choosing between an organization's interests and an individual's. A submission that can articulate a competing interest, rather than asserting that the secure option is obviously right, is doing what the course asks.
Competent or Not Competent is the whole scale. There are no letter grades and no ordinary grade point average, and 4 competency units describes how much of a flat-priced six month term this course occupies.
Turning aspects into a legal analysis plan
If your version of D828 uses a performance assessment, the aspects usually ask you to apply law and framework requirements to a described organization. WGU requires a score of 2 in each aspect for a task to pass and judges each aspect alone, so a strong privacy analysis will not carry an unaddressed ethics or compliance aspect.
Budget before drafting. Take a rubric with six scored aspects and a target near 2,200 words. Reserve 150 words for the organization, its data and where its people are, and 110 for the close, leaving 1,940 across six aspects, or roughly 323 each. Weight by demand: two aspects requiring you to apply a legal or regulatory requirement to facts need 430 each, since each needs the rule, the facts and the conclusion; the four remaining aspects, covering frameworks, ethics, compliance value or policy, take 270 each. Two at 430 plus four at 270 is 1,940 exactly.
Use a fixed order inside every applied paragraph: state the rule, state the relevant facts from the scenario, apply one to the other, then state the conclusion. That structure is how legal reasoning is written everywhere, it is easy to follow, and it makes it obvious to an evaluator which part of your answer is the rule and which is your analysis.
Reserve budget for uncertainty. Where the scenario does not give you enough facts to reach a conclusion, saying what additional fact would decide the question is a genuine answer and a strong one. Inventing the missing fact is not.
Shape for a compliance and legal analysis
D828 deliverables usually analyse an organization's obligations. These proportions fit that document.
| Section | Content | Share |
|---|---|---|
| Organization and data | What the business does, what data it holds, whose data it is and where those people are. | 13 percent |
| Applicable law | Which regimes apply and why, with the connecting factor that brings each one into play. | 18 percent |
| Framework obligations | Standards or contractual requirements in force, and how they differ from the legal duties above. | 15 percent |
| Applied analysis | Rule, facts, application, conclusion, repeated for each obligation that matters here. | 22 percent |
| Ethical dimension | The competing interests involved and the reasoning behind the position you take. | 14 percent |
| Compliance actions | What the organization should do, who owns it, and what evidence would demonstrate compliance. | 13 percent |
| Close | Residual exposure and what facts would change the analysis. | 5 percent |
Sourcing legal and regulatory claims
In this subject the primary source is the instrument itself: the statute, the regulation, the published standard. Cite it directly and quote the operative wording where the wording matters, because summaries drop the conditions and exceptions that decide most real questions. A blog post explaining a regulation is a study aid, not a source.
Official guidance from the regulator or supervisory authority is the next best source and is often more useful than the text alone, because it says how the rule is interpreted in practice. Where guidance exists, cite it alongside the instrument rather than instead of it.
Be explicit that you are analysing rather than advising. Coursework in this area is academic analysis of a scenario, and framing it that way is both accurate and professional. A submission that says what an organization's obligations appear to be, on the facts given, reads better than one that issues instructions as though from counsel.
Currency is essential. Data protection and cybersecurity law changes frequently, and an out of date source can be confidently wrong. Give the version or date of every instrument you cite, and where a rule has changed recently, note it, because that awareness is itself a mark of competence in this field.
Cite in whatever style your task sets out and place each reference beside the claim it supports. Where multiple regimes apply, a comparison table with the obligation, the source and the trigger for each is worth several paragraphs of prose and makes overlapping duties visible at a glance.
What earns Competent here
Competent submissions apply rules to facts rather than describing rules. They identify jurisdiction with a reason, keep legal duty separate from framework obligation, take a position on the ethical question with argument behind it, and end with actions someone could actually take.
Returns follow four shapes. The document summarises regulations at length and never applies them to the scenario. Jurisdiction is assumed rather than established. Ethics is answered with a sentence saying that the organization should act ethically. Or the analysis reaches confident conclusions on facts the scenario never supplied.
One habit lifts these submissions more than any other: write the counter-argument. Compliance questions almost always have a position an organization could reasonably take on the other side, whether that is a cost argument, a competing obligation or a genuine ambiguity in the rule. Naming that position and saying why you still reach your conclusion is what legal reasoning looks like, and it converts a description into an analysis in about forty words.
A quick check: highlight every conclusion in your draft and confirm each one is preceded by the rule it rests on and the fact it applies to. Conclusions floating without those two anchors are the most common weakness in legal writing by students who know the material well.
A returned performance assessment costs nothing in grade terms to rework, so completeness beats polish when you are deciding whether to submit, and let the evaluator find the last gap faster than you would. If your section carries an objective assessment as well, WGU objective assessments are proctored and our boundary is absolute: preparation only, with framework drills, terminology practice and a candid read on your preassessment result. We will not take your exam, give no help from the moment it starts, and we would refuse portal credentials if they were offered.
Summarising the law instead of applying it?
Send the D828 rubric and scenario. We rebuild it as rule, facts, application, conclusion, with word targets for every aspect.
Eight mistakes that cost time in D828
- Describing law instead of applying it. Rule, facts, application, conclusion. Every applied aspect wants all four.
- Assuming jurisdiction. Establish which regime applies and name the connecting factor that brings it into play.
- Blurring legal duty and framework obligation. They arise differently and carry different consequences.
- Citing explanatory articles. Go to the instrument and to regulator guidance. Summaries drop the exceptions.
- Undated sources. This area changes constantly. Name the version and note recent changes.
- Ethics as a slogan. Name the competing interests and argue a position. Asserting that ethics matter is not an argument.
- Inventing missing facts. Say what additional fact would decide the question instead of supplying it yourself.
- Actions with no evidence trail. Compliance is demonstrated, so say what record would prove each action was taken.
Three questions students ask about D828
Do I need a legal background for this course?
Which laws should I focus on?
Is coursework here the same as giving legal advice?
Where D828 sits in WGU's programs
The July 2026 catalog places this code in 1 current WGU program. Open a program page for the complete standard path and term positions. The live Degree Plan remains authoritative after transfer credit, substitutions, and mentor planning.
The assessments, one by one
The public catalog does not publish this course's PA/OA identity or task count. WGU Tutors publishes at most one PA manual per course and only from a WGU-controlled public rubric. Until that source exists, PA help begins from the student's real Course of Study and OA support remains preparation only.