The Data Protection Act 1998 came into force on 1 March 2000. This grants individuals greater right in relation to protection of personal data including:
- The requirements for an individual to consent to the processing of this information (unless it is for a contract with him).
- The right to be informed about the processing of information and the process involved in the computerised decisions.
- The right to object to certain processing for example direct marketing
A web site owner who obtains and retains information relating to an individual's personal data must be aware of the Act's implications and comply with them.
- Anyone receiving "personal information" from customers including names, addresses and payment data is required to notify the Data Protection Commission of the uses to which it is put.
- Failure to comply with the provisions of the Act may expose businesses to claims for compensation from the party providing the data as well as to criminal proceedings.
- A Security policy for personal financial information supplies by customers should be implemented.
- A privacy policy displayed informing customers that they are sending any information at their own risk.


