Rules & Regulations

The Data Protection Act - A Checklist for Businesses

This information is part of the Data topic.

In this topic:

• The Data Protection Act (DPA)
• What it means for your business
• Using customer data
• Direct marketing using email, mail and phone
• Using information in the public domain
• A checklist for businesses

A checklist for your business

The Data Protection Act applies to everyone. It gives individuals certain rights regarding their personal data and places obligations on everyone who holds personal information about living individuals. The following is intended to offer a checklist of recommended minimum procedures in order for a business to comply successfully with the Data Protection Act.

General

1. Make sure your computers, filing systems and buildings are secure.
2. Ensure your staff know how to correctly take down customer data and how to ask the data protection question. Ensure that you and they ALWAYS follow procedure.
3. Ensure that staff who collect customer data know how that data might be used in the future so that they may confidently explain to a customer who asks.

Customer Data

1. Ensure that wherever customer data is taken down, staff ALWAYS ask an appropriate data protection question. This would be along the lines of EITHER "May we send you relevant information in the future?" where the customer data is only ever likely to be used by your own business OR "May we send you relevant information about ourselves and other selected businesses in the future?" if the customer data is likely to be shared with/used by other businesses.
2. Ensure that an appropriate opt-in option is given at websites where customer data can be collected, such as "Please tick here to indicate that we may email you further suitable information in the future." Ensure that where customer data is collected electronically as part of an automated request or booking process that at least an opt-out option is offered.
3. Ensure that any communication you make to a customer offers a suitable, free of charge option to opt-out of any future marketing communications. This is essential on all unsolicited emails you send to customers. A suitable reply address for unsubscribing MUST be provided.
4. Ensure that any emails you send clearly state who the sender is.
5. Ensure you only send your customers suitable information about your core business.
6. You may buy mailing lists or share appropriate data with other organisations for joint marketing, but ensure that when you do this all data is screened against the Mailing Preference Service Register.
7. Ensure that all outbound unsolicited telephone calls to your customers are screened against the Telephone Preference Service Register unless you are conducting follow up calls or research to recent enquirers/customers.
8. You are obliged to correct a customer's details quickly if they advise you of a change or request a deletion.
9. You are obliged to send to a customer a copy of the details of any data that you hold on them, should they request that you do so. You may charge a small administration fee of up to £10 for this if necessary.