It really depends on what is in them. The Act applies to living individuals, so if your records merely trace your dealings with customers which are limited companies, without any mention of individuals, you do not need to worry. Even if individuals are mentioned, but only peripherally, you may still not need to worry (see question six).
Up to midnight on 23 October 2007, if your records suggested that the purchasing manager at one customer liked a good meal, while the managing director at another enjoyed a day at the races, but the information was held in manual files, and would not have been easily accessible to, eg a new temp in the office (because, for instance, they were only identified by their initials or nicknames), you might not have had to notify (though you would have had to observe the principles of the Act - see below and question 1). Now, however, any information about living human beings, other than exempt information (see question 1) or the strictly peripheral, will mean you have to notify. This is because the transitional arrangements under which holders of pre-1998 manual records were exempt from notification ceased with effect from midnight on 23 October 2007.
In particular this means that such information is subject to the first five data protection principles, that information shall be:
- fairly and lawfully processed,
- for limited purposes,
- adequate, relevant and not excessive,
- accurate and up to date, and
- kept no longer than is necessary.
The individuals to whom the information relates also get the right to correct it if it is inaccurate.
Holding such information is in itself a form of processing, so if such manual files exist and do make reference to living individuals, you need to make a decision as to whether you wish to continue holding them, and if so, ensure that you comply with the provisions of the 1998 Act. It does not, however, require you to digitise or computerise such information.
Take legal advice, if in doubt.
