Skip to content
Font size: A A
Contrast: C C C C
Accessibility How to use this site
Call 999 in emergencies or 101 for non-emergencies
Contact us

The Data Protection Act 1998 was brought into force on 1 March 2000 and works in two ways. It gives individuals certain rights. It also says those who record and use personal information must be open about how it is used and must follow the eight principles of 'good information handling'.


Anyone processing personal data must comply with the eight enforceable principles of good practice. Data must be:

  • processed fairly and lawfully  
  • processed for limited purposes  
  • adequate, relevant and not excessive  
  • accurate and up-to-date  
  • not kept longer than necessary  
  • processed in accordance with the data subject's rights  
  • secure  
  • not transferred to countries outside EEA without adequate protection
Page last updated: 11 January 2018