Collecting and storing any sort of confidential data must always be done with the utmost care. The Data Protection Act 1998 outlines the procedures that must be followed by law when storing any personal information about somebody else for business purposes. It requires businesses to only use information for the specific purpose it was provided, states that no information may be passed onto a third party without express consent, and allows individuals to retain the right to access any data stored about them at any time.