The four rules of GDPR are lawfulness, fairness and transparency, purpose limitation, data minimisation and accuracy. These principles aim to ensure that personal data is handled responsibly and with respect for individual privacy.