Can an organisation record a telephone call without telling me?

Yes. In our view, individuals should generally expect that an organisation will keep a record of the call. This could be by recording the call itself or by making notes.

How long can an organisation hold data about me?

The Data Protection Act states that organisations should only keep personal data for as long as it is necessary. Organisations should also have a retention policy for the information they hold.

Can an organisation use my information or pass it on without my consent?

Sometimes – for example, if the police want information in connection with a criminal investigation, or in an event where your health might be at risk. You have certain rights in situations where information might be shared, which you can read about in our guide Sharing my information.

If you think your information has been used unfairly, you should first approach the organisation involved, asking them to explain how they have used your information and how they have followed the Data Protection Act principles. Organisations are obliged to explain how they are processing your personal information if you make a formal request.

How do I get information held about me corrected?

If you have any concerns about the accuracy of your personal data, you will need to raise it in writing with the organisation concerned. You should be clear about exactly what you believe is inaccurate and how the organisation should correct it, providing evidence of the inaccuracies where available. Be aware that the Data Protection Act only obliges organisations to keep information factually accurate, it can't be used to alter or remove opinions, including medical diagnoses, unless those opinions themselves are based on inaccurate factual information.

How do I get an organisation to stop using my data?

Under the Data Protection Act, you may ask an organisation to stop using your information. For further information, read our guidance on preventing the processing of personal data.

How do I get information held about me deleted?

You do not have an automatic right to have personal data deleted. However, you may ask an organisation to stop using your information. For further information, read our guidance on preventing processing of personal information.

I think a decision has been made about me by a computer. What can I do?

The Data Protection Act gives you a limited right to prevent significant decisions being taken about you solely by automatic processing. You can write to an organisation telling it not to make decisions about you on this basis. You should consider sending your letter by recorded delivery and keeping a copy. The organisation has 21 days to respond. It can either reconsider any decision it has made or make a fresh decision not just using a computer. If you are not satisfied with the response, you can go to court and the court can order the organisation to reconsider the decision it has made or take a new decision on a different basis.

What is a privacy notice?

When organisations collect your information, they should usually be open about why they are collecting it, only use it in a reasonable way that you would expect, and shouldn't use it in way that is unfair to you. When your data is collected you should be given a fair processing notice or privacy notice that tells you what will be done with your data and why, unless it's already obvious who has collected your details and what they are going to be used for.

Are organisations allowed to transfer my data to foreign call centres?

Yes, providing the organisation keeps your data secure.