We often hear stories in the news about people’s personal data being leaked or hacked into. This section looks to guide you through some of the fundamental basics around Data Protection that you need to be aware of.
What does the Data Protection Act mean by Data?
Data refers to any information held about any person, whether an employee, a job candidate, a freelancer or customer. This could include but is not limited to:
- name and address
- telephone numbers
- bank account details
- information about ethnic origins
- religious beliefs
- health
- criminal records.
What are the key rules of data protection?
The data protection act has eight key principles that must be adhered to.
- used fairly and lawfully
- used for limited, specifically stated purposes
- used in a way that is adequate, relevant and not excessive
- accurate
- kept for no longer than is absolutely necessary
- handled according to people’s data protection rights
- kept safe and secure
- not transferred outside the European Economic Area without adequate protection.
Every business must have a Data Controller. A data controller is a nominated person in a compnany who applies to the data commissionner fo permission to store and use personal data. The data controller must keep to the eight key principles.
You will need to nominate a Data Controller and register your Data Controller with the Information Commissioners office. More information can be found in Next Steps at the end of this article.
When do I need to think about the Data Protection Act?
As a small business owner you will be storing and processing information about your customers, suppliers and staff on a regular basis. Under the Data Protection Act you are legally obliged to protect all this information securely. Scroll through the carousel images below to find out more.
Quiz: What rights does an employee have to see their personnel records?
An employee has the right to see the data you keep on them. If they ask to look at their record you must let them see a copy. This right is referred to as ‘subject access’. You may charge an administrative or handling fee for this request. How many days do you have to comply with a subject access request?
Correct: 
You have 40 days to provide the information requested. If you charge a fee you are entitled to wait till the fee has been paid before releasing the information.
Incorrect: 
You have 40 days to provide the information requested. If you charge a fee you are entitled to wait till the fee has been paid before releasing the information.
What is the most common amount charged for a subject access request (SAR)?
Correct: 
The correct answer is £10. You cannot make the amount you charge disproportional to the request or the time it takes to administer it. There may be different rules around fees for organisations that hold credit, health or education details.
Incorrect: 
The correct answer is £10. You cannot make the amount you charge disproportional to the request or the time it takes to administer it. There may be different rules around fees for organisations that hold credit, health or education details.
Share this content
Brought to you by:
Sage
Sage Business Cloud Accounting is online accounting software that provides anytime, anywhere access to essential small business tools. Its features help you manage cash flow and send and track invoices, all through the cloud or via a mobile app.
Get limited time offer