Long seen as untouchable in Brussels, the GDPR is next on the list of the EU’s crusade against overregulation.

The principles of data protection under the GDPR are similar to those under the DPA, but include some extra detail. In summary, these are that personal data shall be: ...

A lawful basis must be established before processing begins and should be documented. If no lawful basis applies then the processing will be unlawful and in breach of the GDPR principles.