(1)A person shall not hold personal data unless an entry in respect of that person as a data user, or as a data user who also carries on a computer bureau, is for the time being contained in the register.
(2)A person in respect of whom such an entry is contained in the register shall not—
(a)hold personal data of any description other than that specified in the entry :
(b)hold any such data, or use any such data held by him, for any purpose other than the purpose or purposes described in the entry ;
(c)obtain such data, or information to be contained in such data, to be held by him from any source which is not described in the entry ;
(d)disclose such data held by him to any person who is not described in the entry ; or
(e)directly or indirectly transfer such data held by him to any country or territory outside the United Kingdom other than one named or described in the entry.
(3)A servant or agent of a person to whom subsection (2) above applies shall, as respects personal data held by that person, be subject to the same restrictions on the use, disclosure or transfer of the data as those to which that person is subject under paragraphs (b), (d) and (e) of that subsection and, as respects personal data to be held by that person, to the same restrictions as those to which he is subject under paragraph (c) of that subsection.
(4)A person shall not, in carrying on a computer bureau, provide services in respect of personal data unless an entry in respect of that person as a person carrying on such a bureau, or as a data user who also carries on such a bureau, is for the time being contained in the register.
(5)Any person who contravenes subsection (1) above or knowingly or recklessly contravenes any of the other provisions of this section shall be guilty of an offence.