Data Protection Act 1998: Principles, Rights, and Offences

The Data Protection Act 1998 was the United Kingdom’s principal privacy statute from 1 March 2000 until 25 May 2018, when it was repealed and replaced by the Data Protection Act 2018 and the UK GDPR.¹ It set out eight binding principles for handling personal data, gave individuals rights to see and challenge the information organisations held about them, and put the Information Commissioner in charge of enforcement. The Act replaced a 1984 statute and implemented the EU Data Protection Directive of 1995.² It no longer governs current processing, but its concepts run through the law that succeeded it.

The Eight Data Protection Principles

Schedule 1 required every organisation handling personal data to meet eight rules. A breach of any one could trigger enforcement.³

Personal data had to be processed fairly and lawfully, meaning people should have known their data was being collected and the organisation needed a legitimate legal basis for handling it.
Data could be collected only for specified, lawful purposes, and could not later be used in ways incompatible with those purposes.
The data collected had to be adequate, relevant, and not excessive for the stated purpose.
Personal data had to be accurate and, where necessary, kept up to date.
Data could not be kept for longer than necessary.
Processing had to respect the rights the Act gave to data subjects.
Appropriate technical and organisational security measures were required to guard against unauthorised access, accidental loss, or destruction.
Personal data could not be transferred outside the European Economic Area unless the destination country provided an adequate level of protection.

Sensitive personal data faced an additional hurdle. Processing it lawfully required meeting at least one condition in Schedule 2 (general conditions) and at least one condition in Schedule 3 (sensitive data conditions).³

What Counted as Personal Data

Section 1 defined personal data as information relating to a living individual who could be identified from that data, either alone or together with other information the controller held or was likely to obtain. The definition also covered expressions of opinion about the individual and any indication of an organisation’s intentions towards that person.⁴

Section 2 created a narrower category of sensitive personal data. Because the potential for discrimination or harm was greater, this category was ring-fenced for stricter treatment. It covered:

Racial or ethnic origin
Political opinions
Religious beliefs or other beliefs of a similar nature
Trade union membership
Physical or mental health or condition
Sexual life
The commission or alleged commission of any offence, and any related proceedings or sentences⁴

Processing anything in this list generally required explicit consent, though narrower exemptions existed for areas such as employment law, medical care, and the administration of justice.

Rights the Act Gave Individuals

Part II of the Act translated the principles into rights people could actually use against organisations holding data about them.⁵

Subject Access Requests

Under Section 7, anyone could write to a data controller and ask whether their personal data was being processed. If it was, the controller had to describe the data, explain the purposes of processing, identify the recipients who might see it, and supply a copy in intelligible form. A fee could be charged, capped by secondary legislation at £10 in most cases. The standard response deadline was 40 calendar days. Where data was processed by automated means to evaluate matters such as creditworthiness or work performance, the individual could also ask about the logic involved.

Objecting to Processing and Automated Decisions

Section 10 let an individual serve a written notice objecting to processing likely to cause substantial and unwarranted damage or distress. If the controller refused, the individual could go to court. Section 12 addressed purely automated decisions with significant effects on a person, giving them the right to challenge decisions taken without human involvement. Loan-application algorithms and automated credit scoring were the kind of scenarios this covered.

Correcting Inaccurate Data

Section 14 gave the courts power to order inaccurate data corrected, blocked, erased, or destroyed, and to require the controller to notify third parties who had already received the wrong information.⁶ If someone had actually suffered damage and there was a substantial risk of further breaches, the court could order remedial action beyond simple correction.

Data Controllers and the Information Commissioner

Any organisation that decided why and how personal data was processed counted as a data controller and carried the main compliance burden. Part III required controllers to register with the Information Commissioner before processing personal data, disclosing the types of data involved, the categories of people it related to, intended recipients, and any non-EEA countries it might be transferred to.⁷ The resulting public register let anyone check who was collecting personal information and for what stated purposes. Processing without registering was a criminal offence under Section 21.⁸

Part VI set out the Commissioner’s general duty to promote good practice and support compliance, through guidance, audits, and public awareness work.⁹ The enforcement tools sat mainly in Part V. Where a breach was suspected, an information notice compelled the organisation to hand over specified information. Where a breach was confirmed, an enforcement notice required defined corrective steps such as deleting data or changing processing practices. Ignoring either notice was itself a criminal offence. By the Act’s final years, monetary penalty notices of up to £500,000 could be imposed for serious breaches.

Criminal Offences Under Section 55

Section 55 made it an offence to knowingly or recklessly obtain, disclose, or sell personal data without the controller’s consent.¹⁰ The provision targeted rogue employees, private investigators, and anyone else acquiring personal information through deception or bribery. Defences included necessity to prevent or detect crime, authorisation by law, and public interest. Selling data obtained unlawfully was a separate offence, and even advertising it for sale counted as an offer to sell. Section 55 became prominent in the phone-hacking prosecutions of the early 2010s.

Where the Act Did Not Apply

Part IV carved out exemptions when other interests displaced the default rules. A minister could certify that national security required exemption from any provision of the Act. Crime prevention and tax collection justified departures from the subject access and purpose limitation rules where compliance would tip off the subject of an investigation. Journalism, literature, and art were exempted where processing was carried out with a view to publication and the controller reasonably believed publication would be in the public interest. Research, history, and statistics enjoyed a qualified exemption allowing indefinite retention, provided the data was not used to make decisions about specific individuals and did not cause substantial damage or distress.

What Replaced the 1998 Act

The 1998 Act was repealed on 25 May 2018 by the Data Protection Act 2018, which sits alongside the UK GDPR.¹ Current UK data protection is governed by those two instruments together.¹¹

The successor framework kept much of the older Act’s shape but expanded it. The UK GDPR reduced the principles to seven and added an accountability principle requiring organisations to actively demonstrate compliance through documentation, audits, and training. Subject access requests are now free in most cases, and the response deadline is one calendar month rather than 40 days. A formal right to erasure and a right to data portability were introduced, with no direct equivalent in the 1998 Act. Maximum fines rose to £17.5 million or 4 per cent of annual global turnover, whichever is higher, for the most serious violations, with a lower tier of £8.7 million or 2 per cent for lesser infringements.¹² Anyone dealing with a current data protection question should be looking at the UK GDPR and the 2018 Act, not the 1998 legislation.

1
Legislation.gov.uk. Data Protection Act 2018
2
UK Parliament. Data Protection and Digital Information Bill Explanatory Notes
3
Legislation.gov.uk. Data Protection Act 1998 Schedule 1 – The Data Protection Principles
4
Legislation.gov.uk. Data Protection Act 1998
5
Legislation.gov.uk. Data Protection Act 1998 Part II
6
Legislation.gov.uk. Data Protection Act 1998 Section 14
7
Legislation.gov.uk. Data Protection Act 1998 Part III – Notification by Data Controllers
8
Legislation.gov.uk. Data Protection Act 1998
9
Legislation.gov.uk. Data Protection Act 1998 Part VI – Functions of Commissioner
10
Legislation.gov.uk. Data Protection Act 1998 Section 55
11
GOV.UK. Data Protection
12
Information Commissioner’s Office. Penalties