Under the Data Protection Act, personal data must not be kept for longer than is necessary for its stated purpose, meaning it should be deleted when no longer needed. The act restricts transferring data outside the country without adequate protection and does not permit unrestricted sharing with credit history providers.