Finance firm must lend an ear to data protection rules

JW writes: I am setting up a British branch of a small finance company, which has one other office, in Dublin. I don´t want to fall foul of the data protection act, but our small firm cannot afford to research this. Can you help?

Answer

Any organisation that holds personal data in Britain may need to register under the act. You can check whether you have to by downloading a handbook, Notification Exemptions - A Self Assessment Guide, from the data protection register website (www.dpr.gov.uk). If you do need to register, you must list all the organisations that may gain access to the personal information before you begin to gather data. Each separate organisation is regarded as a data controller in its own right. If your company has trading subsidiaries, each will need to register and comply separately if they plan to share personal data. Divisions or branches are not regarded as data controllers and will fall within the company´s notification unless they are separately constituted. Regardless of whether your British branch is a separate legal entity from your Dublin office, the holding of personal data in Britain may require you to register under the act in Britain. The same may be true for the Dublin office under the equivalent Irish act. Check with the notification helpline on 01625 545740. Remember you must tell the people about whom you keep information if you share it with your Dublin office or any other organisation. Jon Sutcliffe, data protection expert at Kingston Smith, says: "Directors often delegate control to branch managers but must now take responsibility for all data processing in all areas of the business."