Information commissioner publishes data protection Good Practice Guidance note on out

This week the ICO has published a useful Good Practice Guidance note on how to comply with the Data Protection Act (DPA) when outsourcing the processing of personal information.

The Guidance stresses that under the DPA, when a company uses an outside organisation to process personal information on its behalf, the company remains liable for the security and accuracy of information and how the information is used.

To limit this exposure to liability, the Guidance advises that companies considering outsourcing should ensure that they contract only with organisations they can rely on to take proper care of the information they are entrusted with and ensure that mechanisms are in place to enable them to check that the data is being looked after properly. The Guidance also sets out a list of further recommendations.