Data Protection Act could catch UK companies napping

IT services group, NCC, is warning that changes to the UK's Data Protection Act could catch companies unawares.

After the Act is amended, users will have the right to demand to see what information is being held about them, but a survey of UK companies by NCC showed very few are prepared to comply with the letter of the law. The new legislation, expected to come into force by 1 March, will make company directors personally responsible for the secure of customer data.

David Smith, UK assistant data protection registrar, said the survey suggested that much preparation still needed to be done: "We would urge businesses to be looking at what they need to do. Plans ought to be on the drawing-board by now, as the new legislation will bring in some significant changes."

Smith added that the crucial date for businesses is 1 Oct 2001, when the grace period will end and companies must comply with the new regulations. However, he admitted there is already a certain level of non-compliance with the current data protection law and companies should act now to comply.