Small firms must make sure that they are aware of their obligations under the Data Protection Act, one expert has been warned.
David Smith, deputy commissioner at the Information Commissioner's Office (ICO), explained that firms could find themselves at the centre of an investigation if they did not do so.
He said: "[Firms] should let [people] know, if it's not obvious, how they are going to use the information and who they will pass it on to. They have to keep it accurate and secure, and if they don't live up to these obligations [individuals] can complain to the ICO and we will investigate and enforce action."
Mr Smith added that consumers can contact organisations and ask for a copy of any information they hold about them.
If an SME does not comply with a request within 40 days, the applicant can again make a complaint to the ICO.
A recent survey by the ICO found that 80 per cent of people in the UK are now taking greater steps to protect their personal information.
