Source: Wikipedia

The Data Protection Act 1998 was a United Kingdom Act of Parliament designed to protect personal data stored on computers or in an organised paper filing system. It enacted the EU Data Protection Directive 1995's provisions on the protection, processing and movement of data.

Under the DPA 1998, individuals had legal rights to control information about themselves. Most of the Act did not apply to domestic use, for example keeping a personal address book.

Anyone holding personal data for other purposes was legally obliged to comply with this Act, subject to some exemptions. The Act defined eight data protection principles to ensure that information was processed lawfully.

See GOV.UK guidance here >