Most relevant to employers is the fact that data can only be processed with the individual's consent, which should be both specific and informed. Personal data shall be obtained only for specified and lawful purposes and shall not be processed in any manner incompatible with those purposes. Personal data shall be adequate, relevant and not excessive in relation to the purposes for which it is processed. Employers should review files periodically to remove any irrelevant information. Personal data should be accurate and, where necessary, kept up to date.
Employers are responsible for taking reasonable steps to ensure the accuracy of their data.
Consider giving your employees copies of their personnel files on a regular basis so that they can confirm the accuracy of the details. Personal data shall be kept for no longer than is necessary for the purposes for which it was processed. Personal data shall be processed in accordance with the rights of data subjects under the Act. Employers will contravene this principle if they fail to supply information pursuant to a request from an employee. Personal data shall be subject to appropriate technical and organisational measures to protect against unauthorised or unlawful processing and accidental loss, destruction or damage.