Data Protection Act 1998

The Data Protection Act governs the use of personal information by businesses and other organisations. You need to comply with the act if you use personal information as part of your business, for example, because you hold customer details or details of employees.

Personal information is information about a living individual who is identified or who is identifiable. It includes information such as a name and address, bank details, and opinions expressed about an individual.

The NAT and IMP do not require any explicit identification be held on line. They do however record details of a persons date of birth, school gender and ethnicity, which in certain situations might be enough to identify an individual. Therefore we need to comply with the data protection principles and ensure that information is:

• processed fairly and lawfully
• processed for the specified and lawful purposes, and not further processed in any way that is incompatible with the original purpose
• adequate, relevant and not excessive
• accurate and, where necessary, kept up to date
• kept for no longer than is necessary for the purpose for which it is being used
• processed in line with an individual's rights
• kept secure with appropriate technical and organisational measures taken to protect the information
• not transferred outside the European Economic Area (the European Union member states plus Norway, Iceland and Liechtenstein) unless there is adequate protection for the personal information being transferred. This is the generally used wording but in practice the NAT and IMP information will not be transfered at all.
  

ReSURV is registered with the Information Commissioners Office - Registration Number Z8955062.

GALYIC is registered with the Information Commissioners Office - Registration Number Z1019510.

To access the Information Commissioners Office website click here.