Principal 1

1.Personal data shall be processed fairly and lawfully

This means that:

• The data subject must have given their consent to the processing.
• The subject must remain fully informed of how and why you are using the data, if not explicitly mentioned at point of collection.
• You must have a legitimate reason for processing the data.
• You must only use the data for the legitimate reason identified.
• The data must not be used unlawfully to improperly exercise power, infringe copyright, breach a contractual agreement or if it breaches the Human Rights Act.

You may process personal data if the processing is necessary:

• For the performance of a contract, to which the data subject is an agreed party.
• For the taking of steps, at the request of the data subject, with a view to entering into a contract.
• To comply with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.
• To protect the vital interests of the data subject.
• For legal or statutory purposes, or in the public interest.
• For the legitimate purposes of the data controller or a third party, except where this is harmful to the individual’s interests.