Data Protection Act

The Data Protection Act 2018 is the UK law that controls how organisations collect, use, store and share personal data. It covers data held on a computer and data kept in paper records, so a filing cabinet is covered as well as a database.

The Act aims to make organisations treat personal data responsibly and protect it, while giving people a greater say over what happens to their information. Personal data is valuable because it can be copied, shared or sold in huge amounts, and it can also be lost or stolen. Rules are needed to stop information about people being misused.

Personal data means details that relate to a living individual and can be used to work out who that individual is. It may identify them on its own, such as a scan of a signature, or only when combined with other information, such as a nickname used on a forum together with a public profile that names the person's employer. Some personal data is more sensitive than other data and needs even greater care, such as details of a person's beliefs or a fingerprint used to unlock a building.

The organisation that holds the personal data and decides how it is used is responsible for following the Act, not the person the data is about, and this applies to any organisation that holds personal data. The organisation must also be able to show that it follows the rules, for example by keeping records of what it holds, having data protection policies and training its staff.

The Act replaced an earlier data protection law so that the rules match the way organisations now use technology and data.