The Data Protection Act 1988 and the Data Protection (Amendment) Act 2003 govern the processing of all personal data.

The purpose of the Act is to safeguard the privacy rights of individuals regarding the processing of their personal data by those who control such data. In particular, it provides for the collection and use of data in a responsible way, while providing against unwanted or harmful uses of the data.