To process personal information, you must comply with the first Principle of the Data Protection Act – this states that you should tell the person you are going to do this, tell them who their information may be shared with, why and any non-obvious consequences this might have as a result.
This is known as sharing their information ‘fairly’ and helps to build trust with the person. The best ways of processing personal information fairly are to inform people of how you intend to process their information at the point that their information will be obtained and keep them informed. When collecting personal information, you should clearly explain who you are.
It is good practice to present this clearly in writing in the form of a Privacy Notice to the Data Subject/individual. These should include details of how individuals can access their personal information, and who they should write to if they are unhappy about how their personal information has been processed.
There are a number of circumstances where you will be required to collect personal information, and for each circumstance, you should consider the reason that the information is being captured. This should then be clearly explained in your privacy notice.
There are some exceptions when people should not be told their information is being shared, at the time of the sharing if, for example, it would prejudice the prevention or detection of a crime or put someone at increased risk of harm.