|
The Data Protection Act (1998)
protects personal information held about individuals. It applies to information
held on or obtained from computers, and to certain manual records. It gives
rights to the individual data subject and imposes responsibilities on the
individuals themselves, the organizations holding the data, and the
employees of those organizations who use the information.
The Act applies only to information about individuals (such as names,
addresses, personal reference numbers, income, entitlement to benefits). It
does not apply to non-personal data, such as that relating to businesses
and limited companies. The Act only protects personal data about people who
are alive.
The Act is based on a number of underlying principles. However
some principles are more binding than others and for each principle there
are a number of exclusions and exemptions that can be applied. The scope
for misinterpretation or relying on an incorrect exemption can be great and
can lead to fine or prosecution by the Information Commissioner.
While larger organizations may have a dedicated compliance
manager or data protection officer, smaller businesses often incorporate
the duties in other staff roles.
|