e-skills UK Guide

Data protection law

Data protection law and data encryption

The chances are that you would want your business to stay legal and avoid any unnecessary legal action which will distract you from building your company. Adhering to the data protection act is something that you will need to do if you store data on clients, employees or suppliers.

By taking action now you are hopefully going to avoid problems later should your business be investigated. This will save you money and time in the long run, and will only cost you a small registration fee of £35 per annum.

RIPA (Regulation of Investigatory Powers Act) has implications for those using encrypted data.

This guide does not constitute legal advice. It is strongly suggested that you receive qualified legal advice to help you if you have any Data Protection Act or RIPA questions or issues.

Understanding the Data Protection Act

We all like to protect our privacy, and the Data Protection Act provides a legal framework to which we all need to adhere if we are to stay above board. By protecting this information you will retain your reputation and prevent time consuming and costly investigations later.

There are other regulations that apply to anyone considering a telephone or email marketing campaign called the Privacy and Electronics Communications Regulations.

For further detail visit this link Privacy and Electronic Communications Guide

The Data Protection Act allows each of us to know what information is being held about us. Any information that is held must be handled appropriately, and there are 8 guiding principles. Data must be:

●          Fairly and lawfully processed

●          Processed for limited purposes

●          Adequate, relevant and not excessive

●          Accurate and up to date

●          Not kept for longer than is necessary

●          Processed in line with an individual’s rights

●          Secure

●          Not transferred to other countries without adequate protection

If someone should feel that their data is not being managed according to these principles then they can contact the Information Commissioners Office for assistance. At this point your small business may be investigated with possible subsequent enforcement action.

Regulation of Investigatory Powers Act (RIPA Part III)

RIPA is normally associated with investigations into criminals and criminal behaviour using surveillance, not the running of small businesses, but recent changes in legislation may impact your use of IT.

Data encryption is the process of taking normal computer data and files and mixing them up so that they become unreadable to unauthorised users. This process of mixing up or encrypting data uses advanced mathematics, which we won’t bother you with. What you do need to understand is the use of electronic keys to unlock encrypted data. These often take the form of long passwords but act as the secret key to all of your encrypted data. Normally you would keep these keys locked away very securely as if you lose them then your encrypted data could be unlocked by unauthorised users.

As you can imagine many criminals are now encrypting their data to prevent the authorities accessing it. To get around this problem legislation was enacted in October 2007 that forces an individual or a business to hand over their secret encryption key. If you fail to do so then you could face a 5 year jail term.

This is very important for a small business to remember when putting in place data encryption. Always keep your encryption keys secure, but remember that the authorities may, in rare circumstances, demand the key to inspect your data.

Of course we know that users of the Business IT Guide are all upstanding citizens but we would hate to see our users end up in jail!

Data encryption is covered in more detail here.

What you need to do

It is strongly advised that you visit the websites below which carry up to date and accurate information on the Data Protection Act and RIPA as it relates to small businesses. The Data Protection Act site also carries information on how to register your business, which is highly recommended.

Data Protection Act for Small Businesses

Regulation of Investigatory Powers Act

Free security advice

Whether your business has been affected by crime or you are seeking preventative measures against crime, the Business Crime Reduction Centre (BCRC) is here to assist you, contact BCRC by:

Calling: 0114 275 1283
e-mailing: info@bcrc-uk.org
Visiting: http://www.bcrc-uk.org

Commercial suppliers

We do not recommend specific products or suppliers; instead we provide you with a representative sample which covers the range of suppliers/products available. You may choose to look at these suppliers or products but this is entirely at your discretion.