Both the EU and UK GDPR have seven core data protection principles for the lawful processing of personal data.
Lawfulness, fairness and transparency – Information must be used in a manner that is lawful, fair, and transparent. When information is given, data subjects must be told why the data is collected and how it will be used. Additionally, a company must be able to provide details to individuals about what information they have collected about them when asked.
Purpose limitation – The purpose for collection must be identified at the point of collection and not subsequently changed unless it is compatible with the original purpose.
Data minimisation – Ensure personal data processed is adequate, relevant, and limited to what is necessary.
Accuracy – Keep personal data accurate and up to date.
Storage limitation – Keep personal data in an identifiable form only for as long as needed to fulfil its original collection purpose.
Appropriate security – Implement the Confidentiality, Integrity, Availability triad to ensure appropriate security measures protect the data. Organisations are charged with safeguarding personal information collected from their data subjects. They also must invest in a safety plan to protect this information from security breaches.
Accountability – Organisations must be able to demonstrate their compliance.