Outllaw.com — Small companies given data protection guidance

15 February 2007
Small companies should try to answer data protection queries in the normal course of business rather than treat them as formal requests, according to advice published by the Information Commissioner’s Office (ICO).

The ICO has issued guidelines to help small companies deal with requests for information under the Data Protection Act (DPA). Aware that small companies can often feel overwhelmed by such requests and the complexity of the Act, the ICO has advised that as many requests as possible be treated informally.

“Individuals have a right under the Act to make a request in writing for a copy of the information you hold about them on computer and in some manual filing systems,” explains the advice. “This is called a subject access request. They are also entitled to be given a description of the information, what you use it for, who you might pass it on to, and any information you have about the source of the information.”

The advice from the Info Commissioner is here, in a PDF file.