The Data Protection Act 1998 sets rules for 'processing' personal information and applies to paper records as well as those held on computers. Processing means obtaining, recording, storing, sharing, deleting, and otherwise using information.
The Data Protection Act is supervised by the Information Commissioner.
