Under the seventh data protection principle, employers must take steps to ensure that personal information is not processed in an unauthorised or unlawful way, and is not lost, destroyed or damaged.
This is likely to involve setting up systems to ensure that those who have access to personal information, such as employees who work in a management, personnel or payroll function, are aware of their responsibility to keep the information confidential and not to disclose it in an unauthorised wa y. The Data Protection Code (code of practice ) gives guidance on how employers should deal with requests they receive from outside parties for information on employees.
If an employer uses a third party to process information on its behalf, such as an individual contractor or company that provides payroll or personnel services, it must ensure that the third party also has effective security measures in place. The employer must have a written agreement with the third party that it will comply with those measures.