The 1998 Data Protection Act came into force on 1st March 2000.  It sets out rules  for processing personal information and applies to paper records as well as those held on computers.  Replacing the 1984 Data Protection Act it is supervised by the Information Commissioner, currently Richard Thomas.

• Printable Data Protection guidelines are available from the Documents page.

The Principles

Anyone processing personal data must comply with the eight enforceable principles of good practice, which say that data must be:

• fairly and lawfully processed

• processed for limited purposes

• adequate, relevant and not excessive

• accurate

• not kept longer than necessary

• processed in accordance with the data subject's rights

• secure

• not transferred to countries without adequate protection