The Data Protection Act 1998 governs the use of personal information by businesses. If your organisation stores employees or customer records then you must comply with the Act. The Act regulates how a business uses personal information about living identified or identifiable individuals which includes names, addresses and bank details.