The Data Protection Act 1998
Home
Back to Advice and Information
The Data
Protection Act 1998 (DPA) is a United Kingdom Act of Parliament which
defines UK law on the processing of data on identifiable living people. It is
the main piece of legislation that governs the protection of personal
data in the UK. Although the Act does not mention privacy, in practice it
provides a way in which individuals can control information about themselves.
Most of the Act does not apply to domestic use, for example keeping a personal
address book. Anyone holding personal data for other purposes is legally obliged
to comply with this Act, subject to some exemptions. The Act defines eight
data protection principles.
-
Personal data shall be processed fairly and lawfully and, in particular,
shall not be processed unless-
-
at least one of the conditions in Schedule 2 is met, and
-
in the case of sensitive personal data, at least one of the conditions
in Schedule 3 is also met.
-
Personal data shall be obtained only for one or more specified and lawful
purposes, and shall not be further processed in any manner incompatible with
that purpose or those purposes.
-
Personal data shall be adequate, relevant and not excessive in relation to
the purpose or purposes for which they are processed.
-
Personal data shall be accurate and, where necessary, kept up to date.
-
Personal data processed for any purpose or purposes shall not be kept for
longer than is necessary for that purpose or those purposes.
-
Personal data shall be processed in accordance with the rights of data
subjects under this Act.
-
Appropriate technical and organisational measures shall be taken against
unauthorised or unlawful processing of personal data and against accidental
loss or destruction of, or damage to, personal data.
-
Personal data shall not be transferred to a country or territory outside the
European Economic Area unless that country or territory ensures an adequate
level of protection for the rights and freedoms of data subjects in relation
to the processing of personal data.
Home
Back to Advice and Information