The Data Protection Act of 1998 established rules for how companies and organizations collect and use personal data to protect individuals' privacy. It requires that personal data be obtained fairly and lawfully, used for the specified purpose collected, kept securely, and not shared without permission. The Act was introduced because of concerns about how personal data stored in databases could be misused if accessed by unauthorized parties.