ea logo
We are in the process of moving to a single website for the Education Authority. When using this website, please also check the EA website www.eani.org.uk to ensure you are accessing the most up to date information.

The Data Protection Act 1998

  • What is it?

The Data Protection Act 1998 strengthens the rights of individuals in relation to the way personal data is processed.
The Data Protection Act 1998 came into force on 1st March 2000 and it sets rules for processing personal information and applies to paper records as well as those held on computers.

The Data Protection Act in practice
The Data Protection Act 1998 applies to ‘personal data’, that is, data about identifiable living individuals. The SEELB (known as a Data Controller under the legislation) must comply with the rules of good information handling, known as the data protection principles, and other requirements of the Data Protection Act.

The rules of good information handling – the data protection principles
The Board must comply with the eight enforceable principles of good practice which are set out in detail in schedule 1 of the Data Protection Act (1998). The Data Protection principles say that data must be:

  • fairly and lawfully processed;
  • processed for limited purposes and not for any manner incompatible with those purposes;
  • adequate, relevant and not excessive;
  • accurate;
  • not kept for longer than is necessary;
  • processed in line with the data subject’s rights;
  • secure;
  • not transferred to countries without adequate data protection.

Personal data covers both facts and opinions about the individual. It also includes information regarding the intentions of the data controller towards the individual.

The right of subject access
The Data Protection Act (1998) allows individuals to find out what information is held about themselves on computer and some paper records. This is known as the right to subject access. The Board processes these requests in accordance with the legislation.

Requests for such information should be sent to  This email address is being protected from spambots. You need JavaScript enabled to view it. or in writing to the address at the bottom of this page. Alternatively, please click to download the Data Protection Subject Access Request Form.

By law we have to deal with such requests within 40 calendar days.  If you have any complaints in respect of your information request, please submit your complaint in accordance with the Board’s Comments and Complaints Policy which is available on the Board’s website. If you remain dissatisfied at the conclusion of any complaint you may complain to the Information Commissioner at www.ico.org.uk.

Promoting good practice
The Commissioner has a duty to promote good practice by data controllers. One of these is by producing codes of practice.

Information on the codes of practice, which is available from the Information Commissioner, can be found on www.ico.org.uk.