Data Protection and Protecting Yourself

26-Sep-2011

The Data Protection Act 1998 (DPA) governs how people’s data can be collected and used. The DPA is enforced by the Information Commissioner’s Office (ICO), with whom you may need to register if you are controlling or processing personal data.

 

The DPA applies to personal information on a living person who is identified or identifiable, and includes information such as name, address, bank details, and opinions expressed about an individual.

 

If your business holds personal information then you may be classed as a data controller, in which case you must notify the ICO of the data you hold and what it’s used for.

 

It is important that you have in place the relevant terms and conditions and privacy policy to ensure that you comply with the DPA, and your customers are aware of how you are using their data as the penalties for failing to do so can be severe.

 

A key requirement of the DPA is that you comply with the 8 data protection principles. They are that the data has to be:
• processed fairly and lawfully
• processed for limited purposes
• adequate, relevant and not excessive
• accurate and up to date
• not kept for longer than is necessary
• processed in line with the rights of individuals
• secure

• not transferred to other countries without adequate protection

 

Failure to comply with the DPA is a criminal offence and the maximum fine for breaches has recently been raised to £500,000. Ensuring compliance is paramount as in extreme cases the offender can be subject to imprisonment.

 

For further information contact James Wall.

---