References in this Act to the data protection principles are to the principles set out in Part I of Schedule 1.

Those principles are to be interpreted in accordance with Part II of Schedule 1.

Schedule 2 (which applies to all personal data) and Schedule 3 (which applies only to sensitive personal data) set out conditions applying for the purposes of the first principle; and Schedule 4 sets out cases in which the eighth principle does not apply.

Subject to section 27(1), it shall be the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller.