The law and the principles
UK data protection is governed by the UK GDPR and the Data Protection Act 2018. Personal data must be used fairly, lawfully and transparently, for specified purposes, limited to what is necessary, kept accurate, kept no longer than needed and handled with appropriate security.