So, a copy of the entire UK Child Benefit recipient database has gone missing. If you haven’t heard the story, a junior government employee is alleged to have put the entire database of 7 million families receiving the government’s Child Benefit - along with their bank account details - onto two CDs and somehow they’ve got lost in the post. They don’t appear to be at the location they were sent from, nor at the location they were sent to and not in the hands of the courier company who is supposed to have carried them.

It doesn’t surprise me that this has happened. Some might say it was bound to happen sooner or later. But this wasn’t the first time a database has gone missing and it certainly won’t be the last. Moreover, it’s certainly not the first time an organisation has unwittingly compromised the security of individuals on whom it holds sensitive personal data. In February of this year the Nationwide Building Society was fined £980,000 after a laptop containing 11m customer names was stolen from an employees home.

In my view, data is still a word that has lowly status in many organisations. It’s a technical word and everything associated with it tends to sit somewhere between the IT department and the Post Room - you know, that messy corner of the company where people get in at 7.30am and go home at 4.00pm. As a result, data is not a big topic of discussion in board rooms, unless of course, it gets lost. And that’s because someone does some digging and finds out that companies have a legal duty under the Data protection Act 1988 to look after it very carefully.

The Seventh principle of the Data Protection Act is the area that all companies and organisations should be highly familiar with. It states that “Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.” I wonder just how many MD’s, Marketing Directors or government ministers would be tongue-tied if you asked them to quote the Seventh Principle of the Data Protection Act?

Now we are in the Information Age, managers of all organisations should be fully aware of two things; First, they have specific responsibilities for customer data under the 1988 Act and second, that ignorance of the law is no defence. Data is serious stuff; it should be a board room topic not least because that’s where the buck has to stop when it gets lost.