The Data Protection Act 1998 sets out rules for processing personal information and applies to some paper records as well as to those held on computers. The Data Protection Act works in two ways. It gives you certain rights. It also says those who record and use personal information must be open about how the information is used and must follow the eight principles of 'good information handling'.

These say that data must be:

1. fairly and lawfully processed;
2. processed for limited purposes;
3. adequate, relevant and not excessive;
4. accurate;
5. not kept for longer than is necessary;
6. processed in line with your rights;
7. secure;
8. not transferred to countries without adequate protection.

By law, Hambleton District Council has to keep to these principles.

The Data Protection Act 1998 gives individuals who are the subject of personal data ("data subjects") a general right of access to the personal data which relates to them. These rights, known as "subject access rights" are contained in sections seven, eight and nine of the Act.

Individuals can make requests to Hambleton District Council and any other organisation ("data controllers") that hold information about them. Such access to records and other information about those records is known as a "subject access request". Personal data may take the form of computerised records or in some cases, paper records.

Hambleton District Council may require additional information from those making a "subject access request", including confirmation of identity, and sufficient information to locate the information requested.