Incorporate required Data Protection Act aspects into SME IT Policy and processes

The small web design company, which I operate, develops eCommerce solutions for clients, based upon industry-standard frameworks. Developing these eCommerce solutions, and providing technical support for clients, means the company has access to personal (customer) data.

I would like to incorporate any required Data Protection Act requirements into the company IT policy.

I am looking for someone with a good understanding of the Data Protection Act to identify a minimal set of requirements that can be added to the IT policy and day-to-day development/support processes i.e. the key topics that need to be covered.