The Data Protection Act of 1998 imposes obligations on those holding personal data both as to the purposes for which data may be held and to the persons to whom it may be disclosed, and those obligations are particularly stringent in the case of sensitive personal data (as defined in the Act). Further information is available on the University's website.