What does UK Data Protection Act 1998 cover?

The Act covers any data held by a company, organization, or government about a living and identifiable individual. It does not include data held by an individual for their own use such as a person's personal address book. Anonymised or aggregated data is not regulated by the Act, providing the anonymisation or aggregation has not been done in a reversible way.The Act applies only to data which is held, or intended to be held, on computers ('equipment operating automatically in response to instructions given for that purpose'), or held in a 'relevant filing system'.

It regulates the "processing" of "personal data". According to the Act:

"personal data" means data which relate to a living individual who can be identified-

(a)from those data, or

(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

"processing", in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including-

(a)organisation, adaptation or alteration of the information or data,

(b)retrieval, consultation or use of the information or data,

(c)disclosure of the information or data by transmission, dissemination or otherwise making available, or

(d)alignment, combination, blocking, erasure or destruction of the information or data;