"Am I wrong in thinking then that the DPA only affects businesses"
The DPA covers ALL organisations that hold computer data about people, not
just businesses (ie schools, universities, hospitals, local authorities, central
govt bodies, charities etc.,etc.).
Strictly speaking any personal data (ie data that identifies a living
individual) is covered by the act. As someone else noted, the new act also covers any
printed records derived from that data.
However under the original DPA small organisations such as clubs and
societies were given a bit more leeway.
I think email addresses are probably more likely to be 'public domain' but
certainly work addresses and phone numbers are probably covered by the act.
Archaeology Student (ex IT Auditor - although it's a while since I did any
detailed DPA audits)