The Data Protection Act of 1998 sets out obligations organisations must adhere to if they handle personal information. As a small business oner you may not feel this affects you but most businesses hold some personal data on customers or employees. If you do and the information relates to someone who can be identified, you are then referred to as a 'Data Controller' according to the Act.
As a 'Data Controller' you have a number of important responsibilities and be able to abide by eight key data protection principles. These principles state that personal infomation must:
be processed fairly and lawfully: this is the most important requirement of the Act. to comply you must provide individuals with the name of your business and details of the purpose for which their information will be used. You MUST make it clear that the indivudual can access and correct the information you hold about them. Crusically you must tell them if the information will be used in a way that is not immediately obvious such as be passed onto credit reference agency.
be processed for specified lawful purposes: you must specify, lawful reason for collecting data, you CANNOT simply collect it speculatively. You cannot use data collected for another 'incompatible' or unlawful purpose.
be adequate, relevant and not excessive: you shoudl only collect the bear minimum, you may not collect information not immediately relevant to the specified purpose and not collect more information than you need.
be accurate and up to date: any information you hold must be factually accurate and updated where necessary. Depending on your business you may need to develop mechanisms that allow individuals to update their details quickly.
Four more data protection principles in part 2 tomorrow! In the meantime if you have any questions you can give us a call at Wardour Secure Networks on 01476 573599
