Principles

Anyone processing personal data must comply with the eight enforceable principles of good practice. Briefly, they say that the data must be:

• fairly and lawfully processed;
• obtained only for one or more specified and lawful purposes;
• adequate, relevant and not excessive;
• accurate;
• not kept longer than necessary;
• processed in accordance with data subject's rights;
• secure;
• not transferred to countries without adequate protection.