Any business that keeps information on people must comply with the Data Protection Act, which applies to computerised information and to some manual records.