The Data Protection Act 1998 requires that you enter into written agreements with anyone who is processing personal information on your behalf. You need to obtain written guarantees that they will keep the information secure and only use it in accordance with your instructions. It is your responsibility to ensure that the information is used lawfully.
