Want to watch this video? Sign up for the course here. Or enter your email below to watch one free video.

Unlock This Video Now for FREE

This video is normally available to paying customers.
You may unlock this video for FREE. Enter your email address for instant access AND to receive ongoing updates and special discounts related to this topic.

Principle 3 states that personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

The third data protection act principle covers the fact that the data that is collected should be adequate, relevant and not excessive. This means that organisations should ensure that they only hold personal data about an individual that is’ sufficient’ for the purpose and that they do not hold more information than is required for that purpose.

Another example of this may be where it is asked if a person holds a clean driving license when applying for a job that does not require driving.   Organisations must identify the minimum amount of personal data they require and it should not contain irrelevant details. They must not hold more information than is necessary, or hold information that is ‘likely’ to be required in the future.  Where it is necessary to obtain sensitive information it is important that organisations make sure that they collect or retain only the minimum amount of information they need. 

For example, an employer holds the blood group for all of its employees. Only some of them do hazardous work and the information is required in case of an accident. For these employees, it is ok to hold that data but for the rest of the employees, it would be considered irrelevant and excessive.