According to the Data Protection Act, a credit report must be requested only for specific reasons. Other requests that are not necessary or purposeful must be denied.