The 8 principles of the Data Protection Act explained

1
The 8 principles of the Data Protection Act
explained
1

• All Data Controllers must follow the 8 principles
  of the act
• What are these?
• These act like a set of rules that all Data
  Controllers must follow
• They relate to how data is obtained, how it can
  be used, how long it can be kept and how it
  should be kept securely

2
Principle 1
2

• Personal data must not be processed unless there
  is a specific lawful reason to do so

processed
specific lawful reason
3
Principle 1- example
3

• Personal data must not be processed unless there
  is a specific lawful reason to do so

e.g. it would be legal for a casualty department
to gain access to your medical history (to
process it). This is because it protects your
vital interests. (This could save your life)
4
Principle 2- example
4

• Personal data must only be obtained and used for
  limited purposes

e.g. a data controller could not use data that
was collected for a video club membership to send
you information on sports equipment
5
Principle 3- example
5

• Personal data must be adequate, relevant, and
  not excessive

e.g. A video shop would not need to hold details
about your personal finances or if you have a
criminal record
6
Principle 4- example
6

• Personal data must be accurate and kept
  up-to-date

e.g. if the data controller needs to send you
important information, he must have your latest
address.
7
Principle 5- example
7

• Personal data must not be kept longer than
  necessary

e.g. if you are no longer a member of a video
shop, the shop should not keep your personal
details on their computer
8
Principle 6- example
8

• Personal data must be processed in accordance
  with the data subjects rights

e.g. as a data subject you have the right to a
description of the data being held on you. More
on this later.
9
Principle 7- example
9

• Personal data must be protected against loss,
  theft or corruption

e.g. you would not want your medical details to
be accessed illegally
10
Principle 8- example
10

• Personal data must be kept secure and not
  transferred to another country (except one that
  is in the EU or has signed an international
  agreement)

e.g. your data must not be allowed into the hands
of another country unless for a lawful reason.
They must also keep it securely