- Latest available (Revised)
- Point in Time (01/03/2000)
- Original (As enacted)
Version Superseded: 30/03/2016
Point in time view as at 01/03/2000. This version of this schedule contains provisions that are not valid for this point in time.
Data Protection Act 1998, SCHEDULE 1 is up to date with all changes known to be in force on or before 30 August 2024. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
Section 4(1) and (2).
1U.K.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—
(a)at least one of the conditions in Schedule 2 is met, and
(b)in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
2U.K.Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
3U.K.Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
4U.K.Personal data shall be accurate and, where necessary, kept up to date.
5U.K.Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
6U.K.Personal data shall be processed in accordance with the rights of data subjects under this Act.
7U.K.Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
8U.K.Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
1(1)In determining for the purposes of the first principle whether personal data are processed fairly, regard is to be had to the method by which they are obtained, including in particular whether any person from whom they are obtained is deceived or misled as to the purpose or purposes for which they are to be processed.U.K.
(2)Subject to paragraph 2, for the purposes of the first principle data are to be treated as obtained fairly if they consist of information obtained from a person who—
(a)is authorised by or under any enactment to supply it, or
(b)is required to supply it by or under any enactment or by any convention or other instrument imposing an international obligation on the United Kingdom.
2(1)Subject to paragraph 3, for the purposes of the first principle personal data are not to be treated as processed fairly unless—U.K.
(a)in the case of data obtained from the data subject, the data controller ensures so far as practicable that the data subject has, is provided with, or has made readily available to him, the information specified in sub-paragraph (3), and
(b)in any other case, the data controller ensures so far as practicable that, before the relevant time or as soon as practicable after that time, the data subject has, is provided with, or has made readily available to him, the information specified in sub-paragraph (3).
(2)In sub-paragraph (1)(b) “the relevant time” means—
(a)the time when the data controller first processes the data, or
(b)in a case where at that time disclosure to a third party within a reasonable period is envisaged—
(i)if the data are in fact disclosed to such a person within that period, the time when the data are first disclosed,
(ii)if within that period the data controller becomes, or ought to become, aware that the data are unlikely to be disclosed to such a person within that period, the time when the data controller does become, or ought to become, so aware, or
(iii)in any other case, the end of that period.
(3)The information referred to in sub-paragraph (1) is as follows, namely—
(a)the identity of the data controller,
(b)if he has nominated a representative for the purposes of this Act, the identity of that representative,
(c)the purpose or purposes for which the data are intended to be processed, and
(d)any further information which is necessary, having regard to the specific circumstances in which the data are or are to be processed, to enable processing in respect of the data subject to be fair.
3(1)Paragraph 2(1)(b) does not apply where either of the primary conditions in sub-paragraph (2), together with such further conditions as may be prescribed by the [F1 Secretary of State] by order, are met.U.K.
(2)The primary conditions referred to in sub-paragraph (1) are—
(a)that the provision of that information would involve a disproportionate effort, or
(b)that the recording of the information to be contained in the data by, or the disclosure of the data by, the data controller is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.
Textual Amendments
F1Words in Sch. 1 Pt. 2 para. 3 substituted (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), art. 9, Sch. 2 para. 9(1)(b)
Commencement Information
I1Sch. 1 Pt. II para. 3 wholly in force at 1.3.2000; Sch. 1 Pt. II para. 3 in force for certain purposes at Royal Assent see s. 75(2)(i); Sch. 1 Pt. II para. 3 in force at 1.3.2000 insofar as not already in force by S.I. 2000/183, art. 2(1)
4(1)Personal data which contain a general identifier falling within a description prescribed by the [F2 Secretary of State] by order are not to be treated as processed fairly and lawfully unless they are processed in compliance with any conditions so prescribed in relation to general identifiers of that description.U.K.
(2)In sub-paragraph (1) “a general identifier” means any identifier (such as, for example, a number or code used for identification purposes) which—
(a)relates to an individual, and
(b)forms part of a set of similar identifiers which is of general application.
Textual Amendments
F2Words in Sch. 1 Pt. 2 para. 4 substituted (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), art. 9, Sch. 2 para. 9(1)(b)
Commencement Information
I2Sch. 1 Pt. II para. 4 wholly in force at 1.3.2000; Sch. 1 Pt. II para. 4 in force for certain purposes at Royal Assent see s. 75(2)(i); Sch. 1 Pt. II para. 4 in force at 1.3.2000 insofar as not already in force by S.I. 2000/183, art. 2(1)
5U.K.The purpose or purposes for which personal data are obtained may in particular be specified—
(a)in a notice given for the purposes of paragraph 2 by the data controller to the data subject, or
(b)in a notification given to the Commissioner under Part III of this Act.
6U.K.In determining whether any disclosure of personal data is compatible with the purpose or purposes for which the data were obtained, regard is to be had to the purpose or purposes for which the personal data are intended to be processed by any person to whom they are disclosed.
7U.K.The fourth principle is not to be regarded as being contravened by reason of any inaccuracy in personal data which accurately record information obtained by the data controller from the data subject or a third party in a case where—
(a)having regard to the purpose or purposes for which the data were obtained and further processed, the data controller has taken reasonable steps to ensure the accuracy of the data, and
(b)if the data subject has notified the data controller of the data subject’s view that the data are inaccurate, the data indicate that fact.
8U.K.A person is to be regarded as contravening the sixth principle if, but only if—
(a)he contravenes section 7 by failing to supply information in accordance with that section,
(b)he contravenes section 10 by failing to comply with a notice given under subsection (1) of that section to the extent that the notice is justified or by failing to give a notice under subsection (3) of that section,
(c)he contravenes section 11 by failing to comply with a notice given under subsection (1) of that section, or
(d)he contravenes section 12 by failing to comply with a notice given under subsection (1) or (2)(b) of that section or by failing to give a notification under subsection (2)(a) of that section or a notice under subsection (3) of that section.
9U.K.Having regard to the state of technological development and the cost of implementing any measures, the measures must ensure a level of security appropriate to—
(a)the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction or damage as are mentioned in the seventh principle, and
(b)the nature of the data to be protected.
10U.K.The data controller must take reasonable steps to ensure the reliability of any employees of his who have access to the personal data.
11U.K.Where processing of personal data is carried out by a data processor on behalf of a data controller, the data controller must in order to comply with the seventh principle—
(a)choose a data processor providing sufficient guarantees in respect of the technical and organisational security measures governing the processing to be carried out, and
(b)take reasonable steps to ensure compliance with those measures.
12U.K.Where processing of personal data is carried out by a data processor on behalf of a data controller, the data controller is not to be regarded as complying with the seventh principle unless—
(a)the processing is carried out under a contract—
(i)which is made or evidenced in writing, and
(ii)under which the data processor is to act only on instructions from the data controller, and
(b)the contract requires the data processor to comply with obligations equivalent to those imposed on a data controller by the seventh principle.
13U.K.An adequate level of protection is one which is adequate in all the circumstances of the case, having regard in particular to—
(a)the nature of the personal data,
(b)the country or territory of origin of the information contained in the data,
(c)the country or territory of final destination of that information,
(d)the purposes for which and period during which the data are intended to be processed,
(e)the law in force in the country or territory in question,
(f)the international obligations of that country or territory,
(g)any relevant codes of conduct or other rules which are enforceable in that country or territory (whether generally or by arrangement in particular cases), and
(h)any security measures taken in respect of the data in that country or territory.
14U.K.The eighth principle does not apply to a transfer falling within any paragraph of Schedule 4, except in such circumstances and to such extent as the [F3 Secretary of State] may by order provide.
Textual Amendments
F3Words in Sch. 1 Pt. 2 para. 14 substituted (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), art. 9, Sch. 2 para. 9(1)(b)
Commencement Information
I3Sch. 1 Pt. II para. 14 wholly in force at 1.3.2000; Sch. 1 Pt. II para. 14 in force for certain purposes at Royal Assent see s. 75(2)(i); Sch. 1 Pt. II para. 14 in force at 1.3.2000 insofar as not already in force by S.I. 2000/183, art. 2(1)
15(1)Where—U.K.
(a)in any proceedings under this Act any question arises as to whether the requirement of the eighth principle as to an adequate level of protection is met in relation to the transfer of any personal data to a country or territory outside the European Economic Area, and
(b)a Community finding has been made in relation to transfers of the kind in question,
that question is to be determined in accordance with that finding.
(2)In sub-paragraph (1) “Community finding” means a finding of the European Commission, under the procedure provided for in Article 31(2) of the Data Protection Directive, that a country or territory outside the European Economic Area does, or does not, ensure an adequate level of protection within the meaning of Article 25(2) of the Directive.
The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.
Original (As Enacted or Made): The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.
Point in Time: This becomes available after navigating to view revised legislation as it stood at a certain point in time via Advanced Features > Show Timeline of Changes or via a point in time advanced search.
Geographical Extent: Indicates the geographical area that this provision applies to. For further information see ‘Frequently Asked Questions’.
Show Timeline of Changes: See how this legislation has or could change over time. Turning this feature on will show extra navigation options to go to these specific points in time. Return to the latest available version by using the controls above in the What Version box.
Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:
This timeline shows the different points in time where a change occurred. The dates will coincide with the earliest date on which the change (e.g an insertion, a repeal or a substitution) that was applied came into force. The first date in the timeline will usually be the earliest date when the provision came into force. In some cases the first date is 01/02/1991 (or for Northern Ireland legislation 01/01/2006). This date is our basedate. No versions before this date are available. For further information see the Editorial Practice Guide and Glossary under Help.
Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:
Click 'View More' or select 'More Resources' tab for additional information including: