The Data Protection Act: six years on and still poor compliance

Abstract

The Data Protection Act (DPA) 1998 became UK law in March 2000, with the purpose of preventing the misuse of sensitive personal data. It imposed legal obligations on all medical and surgical personnel and has implications for training logbooks, audit and research. Previous studies have shown a poor awareness of and compliance with the Act, which gives us rules to follow when handling patient data. The DPA has tighter controls over electronic data than paper-based data due to the rise in the use of computers for holding such information and their potential for abuse. The aim of this study was to assess compliance with the DPA, particularly with regard to electronic logbooks.