Data controllers must comply with the Provisions of the 1998 Act even if they are exempt from notification.

There are eight Data Protection Principles

In summary they require that data shall be:

1. fairly and lawfully processed
2. processed for limited purposes
3. adequate, relevant and not excessive
4. accurate
5. not kept longer than necessary
6. processed in accordance with the data subjects' rights
7. secure
8. not transferred to countries outside the EEA without adequate protection.

Further information about compliance with the Data Protection Act 1998 can be obtained by / from