The Data Protection Act

Northern Employment Services Limited is on the official register for the Data Protection Act 1998. We are committed to information security within the organisation and to protecting against unauthorised or unlawful processing of personal data and against accidential loss, destruction or damage to personal data.

Below is some general information on The Data Protection Act that you should read to enable you to comply with our legal requirements.

The Data Protection Act 1998 is the law that governs the processing of personal information held on living, identifiable individuals.

The Act requires that you are open about your use of information and follow certain principles for processing that information. These principles are known as the eight data protection principles. The Act also provides individuals with certain rights, including the right of subject access.

The eight principles

The Data Protection Act 1998 sets out eight rules (principles) which you must follow for protecting personal information -

Personal data must be:

  1. Processed fairly and lawfully.
  2. Processed only for one or more specified and lawful purpose. 
  3. Adequate, relevant and not excessive for those purposes.
  4. Accurate and kept up to date - data subjects have the right to have inaccurate personal data corrected or destroyed if the personal information is inaccurate to any matter of fact.
  5. Not kept for longer than is necessary for the purposes it is being processed. 
  6. Processed in line with the rights of individuals - this includes the right to be informed of all the information held about them, to prevent processing of their personal information for marketing purposes, and to compensation if they can prove they have been damaged by a data controller's non-compliance with the Act.
  7. Secured against accidental loss, destruction or damage and against unauthorised or unlawful processing - this applies to you even if your business uses a third party to process personal information on your behalf.
  8. Not transferred to countries outside the European Economic Area (the EU plus Norway, Iceland and Liechtenstein) that do not have adequate protection for individual's personal information, unless a condition from Schedule four of the Act can be met.

If a data controller's processing of personal information does not comply with the principles, the Information Commissioner can take enforcement action against that data controller.

Rights of access

The Data Protection Act 1998 provides the right of access for the subjects of the personal information -

They have the right to:

  • know whether you or someone else on your behalf are processing personal information about them 
  • know what information is being processed, the reason it is being processed and those to whom it may be disclosed 
  • receive a copy of the personal information about them 
  • know about the sources of the information

The access process

To obtain access, an individual must send either a written or electronic request to Northern Employment Services Limited who will charge a fee of £10 to provide the information requested.

A response to a request must be made as quickly as possible, and in any event within 40 days of receiving it, or 40 days from receiving the fee.

You must provide the information requested in permanent form such as in a computer print out, letter or form, unless the supply of such a copy is not possible or you can show that it will involve a "disproportionate effort".

When you provide the data, make sure you don't violate anyone else's rights. For example, if you get a complaint about a worker, and that worker then requests access to their file, this could lead to the complainant being identified. Removing the name of the complainant would solve the problem.

There are several exceptions to the right of subject access, including:

  • information held for management planning, eg plans to promote/make redundant an employee, if it could prejudice the conduct of the employer's business 
  • records of an employer's intentions for negotiations with workers if it would prejudice those negotiations 
  • references given in confidence by the employer 
  • information which would prejudice the prevention or detection of a crime, or the arrest or prosecution of offenders 
  • information which may affect the price of a company's shares 
  • information that may identify someone else may generally be withheld

You must make sure that the individual or individuals responsible for monitoring in your business are aware of the Act and its implications. Keep to a minimum the number of workers who have access to personal information obtained through monitoring.

Applicant Login


Don't have an account? Register Now!

Professional opinion on your CV from our industry experts