Data Protection Act 1998 (c. 29)

SCHEDULES

SCHEDULE 1 U.K. The data protection principles

Part II U.K. Interpretation of the principles in Part I

The seventh principle U.K.

11 U.K. Where processing of personal data is carried out by a data processor on behalf of a data controller, the data controller must in order to comply with the seventh principle—

(a) choose a data processor providing sufficient guarantees in respect of the technical and organisational security measures governing the processing to be carried out, and

(b) take reasonable steps to ensure compliance with those measures.