The Data Protection Act (1998): The Eight Principles

Data must be collected and processed fairly and lawfully

Data may be collected and used only for one or more specified and lawful process.

Data must be adequate, relevant and not excessive for the purpose.

Data must be accurate and up to date

Data must not by kept longer than necessary

Data must be processed in accordance with the rights of the data subjects.

Data ust be kept secure against unauthorised or unlawful processing and accidental loss, damage or destruction.

Data must not be transferred to countried outside the EU unless the country provides adequate levels of protection in relation to the processing of personal data.