The fine will be determined after an investigation to assess the gravity of the breach but the size and finances of the organisation at fault will be factors in determining the level of the fine. Cases will also be assessed on whether the breach was accidental or deliberate, and how much distress the leak of information caused.

Under the Data Protection Act, data can only be used for the purposes for which it is collected and cannot be given to others without the consent of the individual. Everybody has the right to see information that is held about them with the exception of crime-related data.

The new rule is expected to come into force in the UK on 6 April 2010.