Data Protection Act 1998 - Summary

The Data Protection Act (DPA) is a United Kingdom Act of Parliament. It defines a legal basis for the handling in the UK of information relating to living people. It is the main piece of legislation that governs protection of data in the UK. Although the Act does not mention privacy, in practice it provides a way in which individuals can enforce the control of information about them. For more information contact the ICO, details listed below.

To view the complete Data Protection Act 1998 Click HERE.

Data protection principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-

   1. at least one of the conditions in Schedule 2 is met, and

   2. in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

4. Personal data shall be accurate and, where necessary, kept up to date.

5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

6. Personal data shall be processed in accordance with the rights of data subjects under this Act.

7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

Conditions relevant to the first principle

Personal data should only be processed fairly and lawfully. In order for data to be classed as 'fairly processed', at least one of these six conditions must be applicable to that data.

1. The data subject (the person whose data is stored) has consented ("given their permission") to the processing;

2. Processing is necessary for 'the performance of a contract (any processing not directly required to complete a contract would not be "fair");

3. Processing is required under a legal obligation (other than one stated in the contract);

4. Processing is necessary to protect the vital interests of the data subject's rights;

5. Processing is necessary to carry out any public functions;

6. Processing is necessary in order to pursue the legitimate interests of the "data controller" or "third parties" (unless it could unjustifiably prejudice the interests of the data subject).

Accessing information held about You

To obtain a copy of information held about You, contact Matthew Homer on 02476 600 407.  Please note information will only be provided on paper and posted to your current address, at a cost of £10 per page payable upfront.  This is to cover admin and posted costs.  Information will be sent as is on our databases in raw format.  Please allow up to 90 days for delivery.

Revised July 2007