data protection act

• information secured in a locked filing cabinet or password protected
• adequate and relevant but not excessive
• kept for no longer than necessary
• used for only the purposes for which it was intended