A01 chaf6542 06 se fm indd

personal data

 should be:

1 

Fairly and lawfully processed.

In full: ‘Personal data shall be processed fairly and lawfully and, in particular, shall not be 

processed unless – at least one of the conditions in Schedule 2 is met; and in the case of sensi‑

tive personal data, at least one of the conditions in Schedule 3 is also met.’

The Information Commissioner has produced a ‘fair processing code’ which suggests 

how an organisation needs to achieve ‘fair and lawful processing’. This requires:

● 

Appointment of a 

data controller

 who has defined responsibility for data protection 

within a company.

● 

Clear details in communications such as on a website or direct mail of how a ‘