Compliance enforcement

The Information Commissioner has a number of statutory powers:

• to consider a request from an individual an "assessment", i.e. whether or not a data controller is in breach of the DPA
• to issue an information notice to a data controller, requiring information to be provided within a set period of time
• to issue an enforcement notice to a data controller, requiring the data controller to stop processing personal data of a particular kind or in a particular way
• to give notice to enter premises or obtain a warrant to enter premises, and to inspect and seize records and equipment
• to prosecute data controllers, including individuals, who are in breach of the DPA.

Employees of a data controller are only likely to be prosecuted personally if they act in breach of the DPA in a personal capacity, e.g. by using the personal data to which they have access for their personal benefit. Payroll staff cannot be prosecuted if they only ever act on instructions given to them by their employer. The employer should include serious breaches of data protection rules in the organisation's disciplinary procedure.