Data Protection Act 1984

2Personal data shall be held only for one or more specified and lawful purposes.