About the Data Protection Act
The Data Protection Act (DPA) places obligations on us as the data controller while giving rights to you as the data subject. It imposes stringent requirements that any organisation holding personal information must comply with. The legislation states that all processing undertaken must be:
- fair and lawful; and
- used only for a defined purpose; and
- adequate, relevant, not excessive; and
- accurate and up-to-date; and
- deleted when no longer required; and
- processed in accordance with the data subject's rights; and
- kept secure; and
- not transferred to other countries without adequate protection.
Residents have the right to get a copy of the information that is held about them. This is known as a Subject Access Request.