Enforcement and Regulation

The Act is enforced and regulated by the Information Commissioner's Office, an independent public body established to police the use and access of personal data.

The Data Protection Act 1998 stipulates that sensitive information must be securely destroyed to avoid identity theft.  Organisations must ensure they have the correct procedures in place for securely disposing of personal data and ensure those processes protect against unauthorised or unlawful processing of personal data or indeed against accidental loss, damage or destruction.  Failure to comply with the Act may result in criminal prosecution and a maximum penalty of £5,000 plus costs in a Magistrates' Court or an unlimited fine in the Crown Court.

Click here for more information on the secure shredding of confidential data.