Datenschutz-Grundverordnung
Processing of personal information is regulated by the Data Protection Act 2018, supplementing the EU General Data Protection Regulation, which is still in force (in amended form) after the UK's exit from the EU as "retained EU legislation".