The Data Protection Act of 1998 applies to all companies that store and/or maintain information on customers and staff.