Data Protection Principles

Personal data must be handled according to data protection law, and the data protection principles are the main rules an organisation must follow when it collects, stores, uses or shares it. Each principle turns the law into a practical duty.

The principles

Principle	What it means
Lawfulness, fairness and transparency	Have a lawful reason for using the data, use it in ways people expect, and be open about what you do with it.
Purpose limitation	Collect data for a stated lawful purpose and do not reuse it for an unrelated one.
Data minimisation	Collect only the data you need, because data you never hold cannot be lost or misused.
Accuracy	Keep data accurate and up to date, correcting errors.
Storage limitation	Do not keep data longer than necessary.
Integrity and confidentiality (security)	Protect data from loss, misuse and unauthorised access.
Accountability	Be able to prove, with records and policies, that your measures are sufficient.

Three further duties sit alongside the principles. An organisation must not share personal data with third parties without consent or another lawful reason, must not send it to another country unless that country gives adequate protection, and must report a serious data breach to the regulator within 72 hours and tell the people affected without undue delay.

Worked example

A weekend badminton club asks new members for their name, date of birth, emergency contact and any medical condition, because it needs them to run sessions safely. That purpose is stated clearly and nothing extra is collected. The club keeps the records accurate, stores them securely and deletes them once a member leaves. It never sells members' email addresses to a sports shop, and if a laptop holding the records is stolen, it reports the breach to the regulator within 72 hours and warns the members at risk.

The principles

Worked example

Practise this