Generally, personal information about an individual should only be held or processed with that individual's consent, and the purposes for which it is held must be registered with the Data Protection Registrar. Another change which is likely to have a significant impact is that the law will not only cover data held on computers but also in manual or paper form. There are also new restrictions on transferring information abroad, and on the rights of individuals to access data held on them. The 1998 Act introduces a new category of information called ''sensitive personal data'' which attracts a higher level of protection. Such data is defined as inform-ation relating to racial or ethnicnorigins, political opinions, religious or other similar beliefs, trade union membership, physical or mental health or condition, sexual life, commission or alleged commission of an offence, or proceedings or sentencing for any offence.
Many companies retain records of employees' sickness absence.
This information would fall within the definition of sensitive personal data as relating to physical or mental health or condition. If a company or organisation is holding information identified as being ''sensitive personal data,'' they must show that the individual concerned has given explicit consent to that information being held or processed. Companies should ensure all employees who deal with personal information are aware of the provisions of the Data Protection Act and the restrictions which apply. This could be achieved by offering some form of training. In addition, organisations should carry out an audit of the information they hold to ensure they are complying with the Act.