The Data Protection Act 1998

The eight Data Protection Principles state that personal data must be:

• Processed fairly and lawfully 
• Obtained for specific and lawful purposes 
• Adequate, relevant and not excessive for the purposes 
• Accurate and kept up to date 
• Kept no longer than is necessary for its purposes 
• Processed in accordance with the rights of the subject under the Act     

Technical and organisational measures shall be taken against unauthorised processing of personal data and against accidental loss, destruction of, or damage to personal data  

Personal data shall not be transferred to a country outside the European Economic Area without guarantees of adequate protection.