The 1998 Data Protection Act sets the rules for how UK businesses can gather, store and use people’s confidential data. The Act is organised around eight principles of data protection. They include the idea that personal data should be obtained and processed fairly and lawfully, that only the right data should be used, that data should be accurate and so on. Principle Seven covers data security. It states: