The Data Protection Act 1998 says that anyone who records and uses personal information must be open about how that information is used and must follow eight principles of ‘good information handling’. It also gives us all as individuals certain rights, including the right to see information that is held about us and to have it corrected if it is wrong. 

Individuals may seek compensation through the courts if they have suffered damage or distress because of any contravention of the requirements of the Act. Every day, members of the public contact the Information Commissioner about the processing of personal data by data controllers. Compliance with the data protection principles can help to prevent complaints  - and that makes good sense. 

 A data protection audit has three clear objectives:

A data protection audit is a very effective management tool, which can help an organisation to adopt a proactive and best practice approach to data protection, and reduce the risk of prosecution and financial penalties by:

How confident are you that there is a formal data protection system in place at your organisation? How confident are you that your staff and officers are aware of the existence of the data protection system, understand the data protection system, and use the data protection system? How confident are you that your data protection system is, in fact, effective?