
If you handle personal information about individuals, you have a number of legal obligations to protect that information under the Data Protection Act 1998.
The Information Commissioner’s Office (ICO) has detailed information on your responsibilities. See Link.