Data Protection Principles
There are eight principles of good practice. Anyone processing personal information must comply with eight enforceable principles of good information handling practice.
These say that data must be:
- fairly and lawfully processed
- processed for limited purposes
- adequate, relevant and not excessive
- accurate and up to date
- not kept longer than necessary
- processed in accordance with the individual's rights
- not transferred to countries outside European Economic area unless country has adequate protection for the individual
The Information Commissioner's Office website has more information.