Department for Constitutional Affairs - Data Protection Act 1998

Home > People's rights > Data protection > Data Protection Act 1998

Data Protection Act 1998

General

The Data Protection Act 1998 came into force on 1 March 2000. It gives effect in UK law to the 1995 EC Data Protection Directive. The Act strengthens and extends the data protection regime created by the Data Protection Act 1984, which it replaces. This note summarises the main provisions. Further information may be obtained from the Office of the Information Commissioner, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF - telephone: 01625 545745; or from her website : www.dataprotection.gov.uk

Scope

The 1998 Act applies to:

computerised personal data ;
personal data held in structured manual files .

It applies to anything at all done to personal data ("processing"), including collection, use, disclosure, destruction and merely holding personal data.

An enforceable good practice code

Organisations processing personal data ("controllers") must comply with the data protection principles. These require data to be:

fairly and lawfully processed;
processed for limited purposes;
adequate, relevant and not excessive;
accurate;
not kept longer than necessary;
processed in accordance with individuals' rights;
kept secure;
not transferred to non-EEA (European Economic Area) countries without adequate protection.

As part of complying with the principles, controllers must:

meet one of six conditions in order to process personal data;
meet one of a number of further conditions in order to process sensitive data*;
inform individuals when their data are collected.

* Sensitive data are data about a person's ethnic origins, political opinions, religious beliefs, trade union membership, health, sexual life and criminal history.

Individuals' Rights

The Act gives individuals rights to:

gain access to their data;
seek compensation.
prevent their data being processed in certain circumstances;
"opt-out" of having their data used for direct marketing;
"opt-out" of fully automated decision-making about them.

The supervisory authority

The Supervisory authority is the Information Commissioner. He:

enforces the Act's requirements;
promotes compliance and good practice;
manages the notification scheme.

Notification

Controllers must tell the Commissioner about their processing (unless a notification exemption applies). Notification exemptions cover:

Controllers must tell the Commissioner about their processing (unless exempt).
Exemptions cover:

manual records;
core business activities;
charities' membership records.

Exemption from notification does not exempt from the data protection principles.

Transitional Exemption

Until 24 October 2007 there is a transitional exemption for some manual processing from the requirement to comply with certain of the data protection principles:

until 24 October 2001, for certain automated and manual processing;
until 24 October 2007 (more limited) for certain manual processing.

The full text of the Data Protection Act 1998 is available on the Stationery Office website.

Data Protection Act 1998: Subordinate Legislation