The Data Protection Act 2018 is the UK's implementation of the General Data Protection Regulation (GDPR). Everyone responsible for using personal data must follow strict rules called 'data protection principles'. They must make sure the information is: used fairly, lawfully, and transparently. It also Lays out what individuals can do with their data that is held by others.