• This Act will impact all companies who in their "normal course of business" collect, manage, manipulate, analyze, distribute, use, retrieve, store, retain, destroy, delete, or interrogate any form of personal data, be that data from a potential employee, an existing employee previously employed employee, students, parents, contractors. 

  • The Act also includes a section to do with managing Special Personal Information. This deals with information related to political, sexual, religious persuasion and information about children.

  • Personal data which is maintained across borders is also covered by the Act, specifically relating to countries where inadequate information protection frameworks exist, or where companies store their data in the cloud and the actual cloud infrastructure is actually resident in another country. 

  • The Act requires processing the minimum required data, ensuring accuracy and removing data that is no longer required.

  •  Furthermore, the Act requires the responsible party, in this case the School, to take reasonable steps when dealing with collected personal information.