2. Info Hub
  3. Management
  4. Regulatory

  Data Protection Principles advert image shown if present

Image shown for entry if relevant and present

The Data Protection Act 2018 sets out six data protection principles, covering Sections 86 to 91 (within Part 4: Chapter 2).
S.86 First data protection principle (DPP): “the processing of personal data must be … lawful, … [as well] as fair and transparent.”
S.87 Second DPP: “the purpose for which personal data is collected … must be specified, explicit and legitimate, and … [it must] not be processed in a manner that is incompatible with the purpose for which it is collected.”
S.88 Third DPP: “personal data must be adequate, relevant and not excessive in relation to the purpose for which it is processed.”
S.89 Fourth DPP: “personal data undergoing processing must be accurate and, where necessary, kept up to date.”
S.90 Fifth DPP: “personal data must be kept for no longer than is necessary for the purpose for which it is processed.”
S.91 Sixth DPP: “personal data must be processed in a manner that includes taking appropriate security measures as regards risks that arise from processing personal data.”