ABSTRACT
One of the features of the security requirements in the seventh Data Protection Principle is that precautions must be taken against ‘unauthorised’ processing. Your staff must therefore not use data in any way that they are not permitted to, and they must not disclose it to anyone else who is not permitted to have it. But in order for this to make sense, someone has to do the authorising. Unless there are clear guidelines on what is permitted, staff cannot be expected to comply.
