What is “data”?

The personal data rules apply to manual (hard/paper copies) and electronic information about any living individual (the “data subject”). 

This also includes any expression of opinion about an individual and any indication of the intentions you have in respect of that individual.

There are specific provisions relating to “sensitive” personal data such as: race or ethnic origin; political opinions; religious beliefs; trade union membership; health; sexual orientation; and criminal proceedings or convictions.

Sensitive data can only be processed with the explicit consent of the individual if it is required by law for employment purposes, or if dealing with the administration of justice or legal proceedings.  It can also be processed if it is necessary to protect the interests of the individual or another individual.


The DPA gives data subjects the right to:

  • access the personal data that is held about them;
  • challenge the data if it is incorrect;
  • claim compensation for any loss caused; and
  • prevent processing for the purpose of direct marketing.

Prior consent of an individual should be obtained before any marketing is carried out and unsolicited marketing should not be undertaken if an individual is registered with the Mailing Preference Service.