Answers
Only personal data that is adequate, relevant and limited to what is needed is collected and held.
Organisations must take responsibility for the personal data they hold and be able to prove they comply.
Personal data can only be sent abroad if it will get the same level of legal protection.
The UK law that sets out how personal data must be handled, working with the UK GDPR.
The UK regulator that investigates complaints about data misuse and can issue fines of up to £17.5 million.
Personal data must be kept up to date and not misleading, with mistakes put right promptly.
A person can ask an organisation to delete the data it holds about them, and it must comply.
Personal data is kept only as long as it is needed and then erased or made anonymous.
A person can tell an organisation to stop using their data for a specific activity, such as marketing.
Appropriate security measures are in place to protect personal data from unauthorised access, loss or damage.
When personal data is lost, stolen or accessed without permission, and those affected must be informed.
A clear agreement, freely given by a person, that allows an organisation to use their data.
Data is collected only for the specific reasons that were stated, and not used for anything else.
Individuals can ask to see the personal data an organisation holds about them and receive copies.
Data is handled with a valid legal reason, fairly, and people are told how it will be used.