What is meant by security of data?

The seventh Data Protection Principle requires that precautions should be taken against the physical loss or damage of personal data, and that access to and disclosure of personal data should be restricted.

Here are some recommendations that can be useful just for general guidance only, considering the hundreds of indications for keeping data secure:

Manual data

• When not in use, files containing personal data should be kept in locked stores or cabinets to which only authorised staff have access.
• Procedures for booking files in and out of storage should be developed, so that file movements can be tracked.
• Files should be put away in secure storage at the end of the working day, and should not be left on desks overnight.

Electronic data
Attention is drawn in particular to the following policies, which are directly relevant to the security of personal data and other data, like:

• Covering security of usernames, passwords, shared file areas, etc.
• Covering overall responsibility for IT security.
• Duties of staff responsible for servers.
• Authorised use of hardware and software.
• Authorised use of network connections.

• Care must be taken to ensure that PCs and terminals on which personal data are processed are not visible to unauthorised persons, especially in public places. Screens on which personal data are displayed should not be left unattended.
• Particular care must be taken when transmitting personal data. Appropriate security precautions, such as the use of encryption and digital signatures, should be taken when sending personal data by email. Transmission of personal data by fax should generally be avoided.
  

Taken from http://www.soas.ac.uk/infocomp/dpa/policy/security/