Bpp learning Media is an acca approved Content Provider

Storage limitation 
Data must not be held for longer than is needed for the purpose it was collected 
and processed. There should be a justifiable data retention policy that can be 
justified. Data that is not needed must be deleted or anonymised. 
Integrity and 
confidentiality (security) 
Appropriate security measures regarding the risks that might arise in connection 
with the data must be taken. 
The Act has two main aims: 
(a) To 
protect 
individual privacy
. Previous UK law only applied to 
computer-based 
information. The 
2018 Act applies to 
all personal data, in any form.
(b) To 
harmonise data protection legislation 
so that, in the interests of improving the operation of 
the single European market, there can be a 
free flow of personal data 
between the member 
states of the EU.
BPP Tutor Toolkit Copy

---

CHAPTER 2
//
THE BUSINESS ENVIRONMENT 
 
31 
4.4.1 The rights of data subjects 
The Act establishes the following rights for data subjects. 
Right 
Description 
To be informed 
Data subjects must be informed about how their personal data is collected 
and used. Information that must be shared includes (for example) the 
purposes that their data is used for, what the retention period is and who the 
information is shared with. Individuals must be given this information at the 
time that their personal data is collected or within a month if the data was 
collected from another source.
Access 
Individuals have the right to request information held about them either 
verbally or in writing. The requested information must be supplied within one 
month, and (in most circumstances) there should be no charge for it.
Rectification 
Data subjects can request inaccurate or misleading information held about 
them to be rectified. Incomplete information must be made complete. The 
request can be made verbally or in writing and it must be completed within 
one month. Only in limited circumstances can the request be refused.
Erasure 
This is known as the right ‘to be forgotten’. Data subjects may request 
information held about them be destroyed. This request can be made 
verbally or in writing. This right only applies in certain circumstances and a 
reply must be sent to the data subject within one month.