How to protect your business from the Data Protection Act

When the Data Protection Act came into force in 1998, the Government's Information Commission obligingly produced a 60-page guidance document to help employers understand their new obligations. It covered such subjects as recruitment, interviewing, selection, e-mail monitoring and medical testing

Following pressure from employment institutions such as the CBI, the Information Commission subsequently agreed to amend the daft code by issuing four separate 'Codes' dealing with the following issues;

1. Recruitment and selection
2. Employment records
3. Monitoring communications
4. Medical records

Presently the first Code runs to 42 pages, the second to 100 pages. The third code is due to be published at any time, however Richard Thomas, the Information Commissioner, has indicated that he is considering publishing a shorter version of the third code which would apply to small business. The forth code dealing with medical matters is yet to be published, comments Russell Brown, a partner at Glaisyers Solicitors in Manchester.

The codes have the potential to cause monumental headaches for employers, given the amount of information they contain, says Brown. The codes refer to benchmarks for compliance and include notes for guidance for employers. Employers must familiarise themselves and all employees with responsibility for dealing with HR matters with each section of the code, take steps to draft policy documentation and introduce staff training in order to ensure compliance.


Failure to comply may result in the Information Commission serving an enforcement notice. As a result of this, Brown advises that employers should familiarise themselves with parts 1 and 2 of the code (which can be accessed from the Information Commission's website..www.dataprotection.gov.uk.) With regard to implementation, employers should seek the advice of a specialist employment law expert with sound knowledge of the Act.

Russell Brown
Glaisyers Solicitors
0161 832 4666