Hi Jude,
In the UK:
Data Protection Act 1998:
Under the Data Protection Act 1998 every organisation that processes personal information (personal data) must notify the Information Commissioner's Office, unless they are exempt. Failure to notify is a criminal offence.
You can find out if you need to register as a data controller at the Information Commissioner's Office website here:
www.ico.gov.uk
There are some scams around. Don't be fooled by them- get the real facts from the Information Commissioner's Office.
Hope this helps
John