Many businesses believe that registering under the Data Protection Act is all one needs to do to comply with it. This is way off the mark.

The most recent Data Protection Commissioner has highlighted a change in emphasis by the authorities away from registration (which is still important) towards compliance. So, what is "compliance"?

This article can only scratch the surface of this question. Basically, if you store and deal with peoples personal details (which most of us do) on or off-line, then you must:

• Deal fairly with people's information
• Tell them what you collect
• Tell them what you will do with it (and do so!)
• Keep it safe and secure.

The final point is often missed. It is not sufficient just to think you have good virus protection and maybe a firewall for your IT systems. You must do all you reasonably can to fully protect the data. A recent British Chamber of Commerce campaign to advise on security issues is based upon the worrying finding that 93% of firms have experienced a virus attack or irregular intrusion and the even more worrying finding that 61% had experienced one or more computer related crimes. So, you must take steps to avoid that happening to you. Businesses must not only look to protect against things like hacking from outside but also internal theft of information and even misuse of information by an ex disgruntled employee.

• Are you sure your IT system is reasonably secure? (Have you had it checked--this can be done relatively cheaply by specialist IT support services)
• Are your employment contracts up to date and do they include security of data issues?
• Do you have a proper privacy policy, is it made known to site visitors and is it followed?
• Have you considered physical threats such as break-ins to where your computers are?
• Do you dispose of print outs, corrected draft letters etc carefully?
• Do you (fully) wipe hard drives before disposing of old equipment?
• If you send any data to others is it said in your privacy policy that you will and do you have agreements about the security of data with the recipient (and an indemnity if they don't follow that?)

A little care can save you a lot of trouble and embarrassment. Imagine the effect on your business of the publicity surrounding a prosecution for failing to keep customers personal information safe!

If you need help understanding your Data Protection responsibilities or would like to make sure you are fully compliant with the Act contact Woolley & Co by e-mail andrew.woolley@business-lawfirm.co.uk or telephone 01789 267377.