- Processed fairly and lawfully
- Obtained & used only for specified and lawful purposes
- Adequate, relevant and not excessive
- Accurate, and where necessary, kept up to date
- Kept for no longer than necessary
- Processed in accordance with the individuals rights (as defined)
- Kept secure
- Transferred only to countries that offer adequate data protection

The legislation underpinning these principles is complex and not really suitable for direct devolution to all the staff who may have responsibility for personal data. Nor does it provide a measure of compliance. Hence the need for supporting products and information