Data Protection Act 1998

}}The 1998 Act replaced the Data Protection Act 1984 and the Access to Personal Files Act 1987. [1] The Act developed in response to growing concern in the 1990s about how easily personal data would be copied, altered, and shared due to rapid rise of computer systems. By that time, names, addresses, and financial records were often stored digitally instead of physical copies, increasing the risk of misuse and unauthorised access. In response, the EU introduced the Data Protection Directive in 1995, which required all EU counties to pass strong data privacy laws.[2][3]

Short description: United Kingdom legislation

Access to Personal Files Act 1987

Act of Parliament

Parliament of the United Kingdom

Long title| An Act to provide access for individuals to information relating to themselves maintained by certain authorities and to allow individuals to obtain copies of, and require amendment of, such information.
Citation| 1987 c. 37
Dates
Royal assent| 15 May 1987
Repealed| 1 March 2000
Other legislation
Repealed by| Data Protection Act 1998

Status: Repealed

Text of statute as originally enacted

The Privacy and Electronic Communications (EC Directive) Regulations 2003 later changed how organizations could contact people electronically. It introduced the idea of "positive consent," meaning companies needed individuals to agree before sending marketing emails or texts.[4] However, companies could still send messages about "similar products or services" to existing customers unless they opted out.

The Act also influenced other privacy laws, such as the Data Protection (Jersey) Law 2005, which was based on the UK's version.[5] Around this time, the Information Commissioner's Office (ICO) was also created to enforce the Act and handle complaints about data misuse.[6] The ICO later became the UK's main authority for data privacy and protection.[7]

## Contents

* 1 Contents
* 1.1 Scope of protection
* 1.2 Data protection principles
* 1.2.1 Conditions relevant to the first principle
* 1.2.2 Consent
* 1.3 Exceptions
* 1.4 Police and Court Powers
* 1.5 Offences
* 1.6 Practical Issues and Complexity
* 1.7 Definition of personal data
* 1.8 Subject Access Requests and Rights of Individuals
* 1.9 Information Commissioner
* 1.10 Legacy and Article 29 Working Party
* 2 See also
* 3 References
* 4 External links
* 4.1 UK legislation

## Contents

### Scope of protection

Section 1 of the Data Protection Act 1998 defined "personal data" as any information that could identify a living person. This included details such as a name, address, phone number, or email. The Act applied to data stored electronically or in a "relevant filing system," which referred to organised paper records that could be easily searched for personal details.[8]

The law also covered some paper documents if they were arranged in a way that allowed easy access to personal information, such as customer databases kept in folders. This meant businesses could not avoid compliance by claiming their data was not digital.

The Freedom of Information Act 2000 later worked alongsde the DPA by allowing people to access data held by public bodies, while the Durant v Financial Services Authority case clarified how the term "personal data" should be used and interpreted.[9] The Durant case ruled that not all mentions of a person's name count as personal data unless the information is genuinely about the person or it affects or exposes their privacy in any way. This helped narrow down the definition and became one of the most cited cases in UK data protection history.

### Data protection principles

Schedule 1 of the Act listed eight protection principles. These principles required that data must be handled fairly, lawfully, and securely, and that it should not be used in ways that conflict with its original purpose.[10]

1. Personal data shall be processed fairly and lawfully.
2. It shall be obtained only for valid and lawful purposes.
3. It shall be adequate, relevant, and not excessive.
4. It shall be accurate and kept up to date.
5. Information should not be kept for an unnecessarily prolonged period.
6. It shall be processed in accordance with the rights of individuals.
7. It shall be protected against unauthorised access, loss, or damage.
8. It shall not be transferred outside the European Economic Area without adequate protection.

These principles were the foundation of the UK's privacy law and continue to influence current rules under the Data Protection Act 2018 and GDPR.[11] They made it clear that collecting personal data also came with the legal a responsibility of protecting it. Many of these ideas were later simplified into six core principles under the GDPR, but the original structure in the 1998 Act helped set clear expectations for fairness and accountability.[12][13]

#### Conditions relevant to the first principle

The first data protection principle stated that personal data should only be processed fairly and lawfully. To meet this standard, at least one of the several legal conditions had to apply, as listed in Schedule 2 of the Act.[14]

These conditions explained when it was acceptable for an organization to collect or use someone's information. An organization could only process data only if the conditions below were satisfied:

1. The person (known as the data subject) has consented ("given their permission") to the processing.[15]
2. Processing is necessary for starting or continuing a contract.
3. The organization is required by law to process the data.
4. Processing is necessary to protect the person's vital interests (such as in a medical emergency).
5. It was required for official public duties.
6. It is necessary for the legitimate interests of the organization or another party, as long as it does not unfairly harm the individual's rights.[16][17]

These six bases made it clear that not every use of data required direct consent. For example, a hospital could process patient records for treatment without written permissions, or a bank could store account data to fulfill its contract.[18] The idea of "legitimate interest" was especially important, as it gave flexibility to organizations while still protecting individuals from unfair data handling.[19][20]

#### Consent

The Act required that individuals give consent before their personal data could be processed, unless another lawful basis applied. Consent was defined as a "freely given, specific, and informed indication" of agreement.[21][22] Unlike modern privacy laws, the 1998 Act did not always require written consent. People could agree verbally or through actions that showed they accepted the use of their information, as long as it was clear they understood what they were agreeing to.[23]

However, consent had to be appropirate to the person's age and capacity. If an organization planned to use someone's data even after their relationship ended, such as for future marketing, this needed to be stated clearly when the consent was obtained.

The Act also created a higher standard for sensitive personal data, which included topics such as race, religion, health, and criminal history. In those cases, consent had to be explicit, often requiring written proof or clear affirmative action.[24] Later updates, such as the Privacy and Electronic Communications Regulations (2003), built on this by making opt-in consent mandatory for most digital marketing.[25] This change helped shape how modern companies handle emails, online cookies, and subscriptions.[26]

### Exceptions

The Act stated that all processing of personal data was covered by its rules unless a specific exemption applied.[27] These excemptions, listed in Part IV of the Act, allowed certain activities to bypass some or all of the data protection principles when necessary.[28]

* Section 28 – National security. Any processing carried out for national security purposes was exempt from all eight data protection principles, as well as Part II (subject access rights), Part III (notification), and Part V (enforcement).[29]
* This exemption was used only in limited situations where applying the full rules could interfere with security investigations.
* Section 29 – Crime and taxation. Personal data used to prevent or detect crime, catch offenders, or assess and collect taxes was exempt from the first data protection principle.
* This meant law-enforcement agencies could request or use information without consent if it directly supported a criminal investigation or tax-related duty.
* Section 36 – Domestic purposes. Personal data used solely for an individual's personal family, or household activities was exempt from all the data protection principles and the Act's formal notification rules.
* Common examples included personal address books, home photo collections, or private communications that were not related to business or professional use.

These exemptions were designed to balance individual privacy with wider public interests. They ensured that the Act did not block essential activities, such as national-security work or criminal investigations, while still protecting everyday personal data from unnecessary misuse.[30]

### Police and Court Powers

The Act gave specific powers to police forces and courts when handling or requesting personal data.

* Under Section 29, consent of the data subject was not required if information was processed to prevent or detect crime, to prosecute offenders, or to meet tax-collection duties.[31]
* This meant the police could obtain data such as phone records or financial details if it was relevant to an investigation. Courts could also order the disclosure of records when necessary for legal proceedings.
* Section 35 allowed data to be shared if required by law or by a court order. This ensured that legal processes were not blocked by data-protection claims.[32]
* Even with these powers, public bodies were expected to protect confidentiality. Any data shared under these sections still had to be stored securely and used only for the stated purpose. The ICO later published guidance to help law-enforcement agencies apply these rules fairly.

### Offences

The Act created several civil and criminal offences for the misuse of data These applied mainly to organizations or individuals who handled information irresponsibly.

* Section 21(1) made it an offence to process personal data without proper registration.[33]
* Section 21(2) penalised failures to follow notification requirements[33]
* Section 55 made it illegal to obtain or disclose personal data without authority, which covered hackers, impersonators, and employees who accessed files without permission. [34]
* Section 56 made it a criminal offence to force someone to make a subject-access request to reveal their criminal record during hiring or employment checks.[35] This rule came into force on 10 March 2015.

Most of these offences were punishable by fines, but serious or repeated violations could lead to stronger legal action and damage an organization's reputation. Many cases ended with public warnings or court orders from the Information Commissioner.[36]

These sections highlighted that the DPA was not just advisory; it had real legal weight.[37] Organizations had to show they were taking data protection seriously or risk criminal liability. In practice, many companies struggled at first to understand their duties.[38] Training programs and compliance audits later became common ways to avoid penalties.

### Practical Issues and Complexity

The Data Protection Act 1998 was known for being quite complex, especially for smaller organizations that did not have legal or technical teams. Many people found the wording difficult to follow, and it was not always clear how the rules applied in day-to-day situations.[39][40]

Early on, businesses and public bodies often misunderstood what counted as "personal data" or how long they were allowed to keep information. Some organizations even used the Act as a reason to refuse sharing publicly available information, which showed how confusing the guidance could be at the time.[41][42] The Information Commissioner's Office later published simplified explanations and examples to help organizations follow the rules correctly. These guides encouraged clearer communication with the public and better record keeping practices.

Over time, training sessions and compliance checks became more common, especially in schools, hospitals, and local councils.[43] These efforts helped raise awareness of the Act, but they also showed how challenging it was for many groups to keep up with changing privacy expectations.

### Definition of personal data

Under the Act, personal data referred to information about a living person who could be identified from the data alone or when combined with other information. Examples included names, addresses, phone numbers, and financial details.[44]

The Act also recognized sensitive personal data, which required extra protection. This included information about a person's racial or ethnic background, political views, religious beliefs, trade-union membership, health records, sexual life, or criminal history: any information that was beyond just identifying a person.[45]

The Durant v Financial Services Authority case later narrowed the meaning of personal data by stating that the information must be significantly connected to the individual, not just mention their name in passing.[46] This decision influenced how organizations interpreted the law for several years.[47]

These definitions became important as more data started being stored electronically. They helped establish the difference between general information and details that required stronger safeguards, especially in workplaces, healthcare, and government agencies.[43]

### Subject Access Requests and Rights of Individuals

One of the most important parts of the Act was the set of rights it gave to individuals, known as data subjects. These rights allowed people to understand and control how their personal information was being used.

Subject Access Requests (SARs):

* Under Section 7, individuals could make a Subject Access Request to see the information an organization held about them. Companies usually had to respond within a set time and could only charge small fees in certain cases. SARs were commonly used to check for mistakes, understand how decisions were made, or confirm whether personal data had been shared with others. This became an important way for people to protect their privacy in the workplace, medical settings, and online services.

Other Rights Under the Act

Individuals also had several additional rights, including:

* The right to have incorrect data corrected (section 14).[48]
* The right to stop processing that could cause damage or distress (Section 10).[49]
* The right to prevent use of data for direct marketing (section 11).[50]
* The right to claim compensation if they suffered harm due to misuse of their data (Section 13).[51]

These rights gave people more control over their information at a time when companies were collecting larger amounts of digital data. Many early complaints handled by the ICO involved inaccurate records, unwanted marketing messages, or unclear privacy notices. After the GDPR and Data Protection Act 2018 took effect, several of these rights were expanded or strengthened, but the foundations began with the DPA 1998.[52]

### Information Commissioner

The Information Commissioner's Office (ICO) was responsible for overseeing and enforcing the Data Protection Act 1998.[53] The ICO provided guidance, answered public questions, and investigated complaints about how organizations handled personal data.[54]

Many complaints involved issues such as inaccurate records, unwanted marketing, or unclear privacy notices. To help both the public and organizations, the ICO published practical guides and examples explaining how the Act should be followed.

The ICO also maintained the public register of data controllers, which listed organizations that were legally required to notify how they processed data.[55] Failure to register or follow basic obligations could result in warnings or fines.[56]

As data use increased in schools, businesses, and healthcare settings, the ICO encouraged stronger security practices to reduce accidental loss or unauthorized access to personal information.[57]

### Legacy and Article 29 Working Party

The Article 29 Working Party was a European advisory group made up of representatives from each EU member state's data-protection authority.[58] It issued opinions and guidance to help interpret the 1995 Data Protection Directive, including how rules about consent, fairness, and international data transfers should be applied.[59][60] Its opinion helped shape how the DPA 1998 was understood in the UK, especially in areas where the Act's wording was unclear. UK organizations often relied on these documents when deciding how to meet the law's requirements.

The Working Party later helped EU countries prepare for the General Data Protection Regulation (GDPR), which replaced the directive.[61] When GDPR came into force in 2018, the DPA 1998 was repealed and replaced by the Data Protection Act 2018.[62]

Although the 1998 Act is no longer in force, it laid the foundation for modern UK privacy law and introduced many concepts that continue today.

## See also

* Computer Misuse Act 1990
* Data privacy
* Data Protection Act, 2012 (Ghana)
* Data Protection Directive (EU)
* Freedom of Information Act 2000
* Gaskin v United Kingdom
* General Data Protection Regulation – a 2016 EU regulation on data protection
* List of UK government data losses
* Privacy and Electronic Communications (EC Directive) Regulations 2003
* Smith v Lloyds TSB Bank plc

## References

1. ↑ "House of Lords: Data Protection and Digital Information Bill". https://publications.parliament.uk/pa/bills/lbill/58-04/030/en/5804030en04.htm.
2. ↑ Bignami, Francesca (2007-06-01). "Privacy and Law Enforcement in the European Union: The Data Retention Directive". Chicago Journal of International Law 8 (1). ISSN 1529-0816. https://chicagounbound.uchicago.edu/cjil/vol8/iss1/13.
3. ↑ "Directive - 95/46 - EN - Data Protection Directive - EUR-Lex" (in en). https://eur-lex.europa.eu/eli/dir/1995/46/oj/eng.
4. ↑ "What are PECR?" (in en). 2024-12-10. https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/what-are-pecr/.
5. ↑ "2023 Guide To Data Protection In Jersey | GDPR Jersey | Appleby" (in en-US). Appleby. 2022-02-01. https://www.applebyglobal.com/publications/data-protection-guide-jersey/.
6. ↑ "Our history" (in en). 2025-09-03. https://ico.org.uk/about-the-ico/our-information/history-of-the-ico/our-history/.
7. ↑ Jersey: Data Protection In Jersey And Other Offshore Jurisdictions 23 July 2008 Article by Wendy Benjamin, mondaq.com,
8. ↑ "Data Protection Act 1998, Basic interpretative provisions". Office of Public Sector Information. http://www.legislation.gov.uk/ukpga/1998/29/section/1.
9. ↑ "What is personal data? Information Commissioner updates guidance". Pinsent Masons. 30 August 2007. http://www.out-law.com/page-8427. "In the case involving Michael Durant he sought information held on him by the Financial Services Authority. The Court of Appeal ruled that just because a document contained his name it was not necessarily defined as personal data. This changed the perception of how wide a definition of personal data could be."
10. ↑ Info, C. X.. "The eight data protection principles" (in en-gb). https://www.fareham.gov.uk/about_the_council/data_protection/dataprotprin.aspx.
11. ↑ "Data protection" (in en). https://www.gov.uk/data-protection.
12. ↑ Maxwell, F., Six Principles of GDPR, Quality Compliance Systems Ltd., published 3 February 2020, accessed 3 January 2024
13. ↑ "Data Protection Act 2018 - The 7 Principles You Need to Know" (in en-GB). 2024-05-13. https://www.privacyhelper.co.uk/knowledge-hub-articles/the-data-protection-act-2018-the-7-principles-you-need-to-know/.
14. ↑ "Data Protection Act 1998" (in en). https://www.legislation.gov.uk/ukpga/1998/29/schedule/2/enacted.
15. ↑ "First Principle - Schedule 2 | Legal and Information Assurance Services" (in en). https://le.ac.uk/ias/data-protection/data-protection-principles/schedule-2.
16. ↑ OPSI.gov.uk Data Protection Act 1998 Schedule 2
17. ↑ "Data Protection Act 1998 - what you need to know" (in en). https://www.lawscot.org.uk/members/journal/issues/vol-48-issue-05/data-protection-act-1998-what-you-need-to-know/.
18. ↑ "The Data Protection Act 1998" (in en-GB). 2018-11-30. https://www.lawteacher.net/acts/data-protection-act-1998.php.
19. ↑ "What is the 'legitimate interests' basis?" (in en). 2025-09-09. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/what-is-the-legitimate-interests-basis/.
20. ↑ Al-Shahi, R.; Warlow, C. (2000-10-28). "Using patient-identifiable data for observational research and audit". BMJ (Clinical Research Ed.) 321 (7268): 1031–1032. doi:10.1136/bmj.321.7268.1031. ISSN 0959-8138. PMID 11053151.
21. ↑ "Art. 4 GDPR – Definitions" (in en-US). https://gdpr-info.eu/art-4-gdpr/.
22. ↑ Mourby, Miranda; Gowans, Heather; Aidinlis, Stergios; Smith, Hannah; Kaye, Jane (2019-07-15). "Governance of academic research data under the GDPR—lessons from the UK" (in en). International Data Privacy Law 9 (3): 192–206. doi:10.1093/idpl/ipz010. ISSN 2044-3994. https://academic.oup.com/idpl/article/9/3/192/5536592.
23. ↑ Iversen, Amy; Liddell, Kathleen; Fear, Nicola; Hotopf, Matthew; Wessely, Simon (2006-01-21). "Consent, confidentiality, and the Data Protection Act". BMJ (Clinical Research Ed.) 332 (7534): 165–169. doi:10.1136/bmj.332.7534.165. ISSN 1756-1833. PMID 16424496.
24. ↑ "Data Protection Act 1998" (in en). https://www.legislation.gov.uk/ukpga/1998/29/schedule/3/enacted.
25. ↑ "What are PECR?" (in en). 2024-12-10. https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/what-are-pecr/.
26. ↑ "Conditions for Processing – Guide to Data Protection – ICO". Information Commissioner's Office. http://www.ico.org.uk/for_organisations/data_protection/the_guide/conditions_for_processing.aspx.
27. ↑ Cite error: Invalid `<ref>` tag; no text was provided for refs named `exemptions`
28. ↑ "Data Protection Act 1998" (in en). https://www.legislation.gov.uk/ukpga/1998/29/part/IV.
29. ↑ "Data protection - Court Stage - Enforcement Guide (England & Wales)" (in en). https://www.hse.gov.uk/enforce/enforcementguide/court/reporting-data.htm.
30. ↑ "National Security Certificates: Broad exemptions from the data protection regime will have consequences for our data protection rights and for adequacy | Privacy International" (in en). http://privacyinternational.org/news-analysis/1862/national-security-certificates-broad-exemptions-data-protection-regime-will-have.
31. ↑ Data Protection Act 1998, Part IV (Exceptions – Crime and taxation), Section 29
32. ↑ Data Protection Act 1998, Part IV (Exemptions – Disclosures required by law or made in connection with legal proceedings etc.), Section 35
33. ↑ 33.0 33.1 Data Protection Act 1998, Part III (Notification by Data Controllers), Section 21 , Office of Public Sector Information)
34. ↑ Data Protection Act 1998, Part VI (Miscellaneous and General), Section 55 , Office of Public Sector Information, accessed 14 September 2007
35. ↑ Data Protection Act 1998, Part VI (Miscellaneous and General), Section 56 , Office of Public Sector Information, accessed 14 September 2007
36. ↑ "Facebook Fine From The ICO" (in en). https://www.shoosmiths.com/insights/articles/facebook-fine-from-the-ico-14386.
37. ↑ "Data Protection Act 1998 overview | BCS" (in en). https://www.bcs.org/articles-opinion-and-research/data-protection-act-1998-overview/.
38. ↑ Redsell, S. A.; Cheater, F. M. (August 2001). "The Data Protection Act (1998): implications for health researchers". Journal of Advanced Nursing 35 (4): 508–513. doi:10.1046/j.1365-2648.2001.01867.x. ISSN 0309-2402. PMID 11529949.
39. ↑ Giualia (2016-06-21). "Data Protection Act 1998: a summary" (in en-US). https://aphaia.co.uk/data-protection-act-1998-summary-2/.
40. ↑ "Data Protection Act 1998 - what you need to know" (in en). https://www.lawscot.org.uk/members/journal/issues/vol-48-issue-05/data-protection-act-1998-what-you-need-to-know/.
41. ↑ Iversen, Amy; Liddell, Kathleen; Fear, Nicola; Hotopf, Matthew; Wessely, Simon (2006-01-19). "Consent, confidentiality, and the Data Protection Act" (in en). BMJ 332 (7534): 165–169. doi:10.1136/bmj.332.7534.165. ISSN 0959-8138. PMID 16424496.
42. ↑ "Chapter 3" (in en). https://www.gov.scot/publications/getting-priorities-right-gopr/pages/6/.
43. ↑ 43.0 43.1 Webb, Jill B. (September 2002). "The Data Protection Act 1998: an audit of its effect on surgical trainees' practice". Annals of the Royal College of Surgeons of England 84 (5): 348–351. doi:10.1308/003588402760452501. ISSN 0035-8843. PMID 12398131.
44. ↑ "Art. 4 GDPR – Definitions" (in en-US). https://gdpr-info.eu/art-4-gdpr/.
45. ↑ "What personal data is considered sensitive? - European Commission" (in en). https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/legal-grounds-processing-data/sensitive-data/what-personal-data-considered-sensitive_en.
46. ↑ "OBEP: Olivia Whitcroft | Article: Subject access requests – recent developments". https://www.obep.uk/article/20130921-subject-access-requests-recent-developments.html.
47. ↑ "Court of Appeal decision on disclosure of mixed data" (in en). 2021-08-09. https://www.taylorwessing.com/en/insights-and-events/insights/2018/07/court-of-appeal-decision-on-disclosure-of-mixed-data.
48. ↑ "Data Protection Act 1998" (in en). https://www.legislation.gov.uk/ukpga/1998/29/section/14.
49. ↑ "Data Protection Act 1998" (in en). https://www.legislation.gov.uk/ukpga/1998/29/section/10.
50. ↑ "Data Protection Act 1998" (in en). https://www.legislation.gov.uk/ukpga/1998/29/section/11.
51. ↑ "Data Protection Act 1998" (in en). https://www.legislation.gov.uk/ukpga/1998/29/section/13.
52. ↑ "Data Protection Act 1998 overview | BCS" (in en). https://www.bcs.org/articles-opinion-and-research/data-protection-act-1998-overview/.
53. ↑ "Data Protection Act 1998" (in en). https://www.legislation.gov.uk/ukpga/1998/29/section/40.
54. ↑ "What is the Information Commissioner's Office (ICO)?" (in en). 2019-09-05. https://www.itpro.com/information-commissioner/31751/what-is-the-information-commissioner-s-office-ico.
55. ↑ "Notification to process personal data - GOV.UK" (in en). https://www.gov.uk/find-licences/notification-to-process-personal-data.
56. ↑ "Data Protection Enforcement in the United Kingdom" (in en-US). https://www.globalcompliancenews.com/data-privacy/data-protection-enforcement-in-the-united-kingdom/.
57. ↑ "Information Commissioner's Office - What exactly does it mean?" (in en-GB). https://www.privacyengine.io/resources/glossary/information-commissioners-office-ico/.
58. ↑ "Legacy: Art. 29 Working Party | European Data Protection Board". https://www.edpb.europa.eu/about-edpb/who-we-are/legacy-art-29-working-party_en.
59. ↑ "UK GDPR guidance and resources" (in en). 2025-10-09. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/.
60. ↑ "Article 29 Working Party" (in en-US). https://epic.org/article-29-working-party/.
61. ↑ "Guidance from the European Data Protection Board | Data Protection Commission" (in en). https://www.dataprotection.ie/dpc-guidance/guidance-from-the-european-data-protection-board.
62. ↑ "ECSH10500 - Data Protection Act 2018/General Data Protection Regulation: introduction - HMRC internal manual - GOV.UK" (in en). https://www.gov.uk/hmrc-internal-manuals/economic-crime-supervision-handbook/ecsh10500.

## External links

* Information Commissioner's Office
* The Department for Constitutional Affairs
* Council of Europe – ETS no. 108 – Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (1981) – basis for Data Protection Act 1984
* Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data – basis for Data Protection Act 1998
* Durant v Financial Services Authority [2003] EWCA Civ 1746
* "Data Protection Act 2018". Act of Error: the `date` or `year` parameters are either empty or in an invalid format, please use a valid year for `year`, and use DMY, MDY, MY, or Y date formats for `date`. 2018 c. 12. https://www.legislation.gov.uk/ukpga/2018/12/resources. Retrieved 2024-04-26. of '''Error:+the+`date`+or+`year`+parameters+are+either+empty+or+in+an+invalid+format,+please+use+a+valid+year+for+`year`,+and+use+DMY,+MDY,+MY,+or+Y+date+formats+for+`date`'''&rft.volume=2018+c.+12&rft_id=https://www.legislation.gov.uk/ukpga/2018/12/resources&rfr_id=info:sid/en.wikibooks.org:Data_Protection_Act_1998">

### UK legislation

* Text of the Data Protection Act 1998 as in force today (including any amendments) within the United Kingdom, from legislation.gov.uk.

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Data Protection Act 1998. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Data_Protection_Act_1998&oldid=4229936"