<P> Additionally, consent should be appropriate to the age and capacity of the individual and other circumstances of the case . E.g., if an organisation "intends to continue to hold or use personal data after the relationship with the individual ends, then the consent should cover this ." And even when consent is given, it shouldn't be assumed to last forever . Although in most cases consent lasts for as long as the personal data needs to be processed, individuals may be able to withdraw their consent, depending on the nature of the consent and the circumstances in which the personal information is being collected and used . </P> <P> The Data Protection Act also specifies that sensitive personal data must be processed according to a stricter set of conditions, in particular any consent must be explicit . </P> <P> The Act is structured such that all processing of personal data is covered by the act, while providing a number of exceptions in Part IV . Notable exceptions are: </P> <Ul> <Li> Section 28--National security . Any processing for the purpose of safeguarding national security is exempt from all the data protection principles, as well as Part II (subject access rights), Part III (notification), Part V (enforcement), and Section 55 (Unlawful obtaining of personal data). </Li> <Li> Section 29--Crime and taxation . Data processed for the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of taxes are exempt from the first data protection principle . </Li> <Li> Section 36--Domestic purposes . Processing by an individual only for the purposes of that individual's personal, family or household affairs is exempt from all the data protection principles, as well as Part II (subject access rights) and Part III (notification). </Li> </Ul>

Who needs to comply with the data protection act 1998