The Data Protection Act 1998

This is a law that states how companies must handle peoples personal data and includes 8 key principles:

Personal data must be fairly and lawfully processed

Personal data must be obtained for specified and lawful purposes

Personal data must be adequate, relevant and not excessive

Personal data must be accurate and up to date

Personal data must not be kept for longer than is necessary

Personal data must be processed in line with peoples rights

Personal data must be held securely

Personal data must not be transferred to other countries outside the European Economic Area, unless those countries have similar data protection laws