The three main data protection policies are outlined in the GDPR: lawfulness, fairness, and transparency. These principles ensure that personal data is processed in a lawful and fair manner, with transparent communication to individuals about the use of their data. It is crucial for organizations to incorporate these principles into their data protection policies to uphold privacy and compliance.