Data Protection Act 1998 - principles
Data must be processed fairly and lawfully
Data must be adequate, relevant and not excessive
Data must be accurate and up to date
Data must not be retained for longer than necessary
Data can only be used for the purpose for which it was collected
Data must be handled in accordance with people's rights
Data must not be transferred outside the EU without adequate protection