What is GDPR?

The General Data Protection Regulation (GDPR) — retained in UK law as UK GDPR after Brexit — is the primary framework governing how organisations collect, store and process personal data. It grants individuals rights including access, rectification, erasure and portability of their data. Organisations must have a lawful basis for each processing activity, keep records of processing, and appoint a Data Protection Officer if they handle data at scale or process sensitive categories. The Information Commissioner's Office (ICO) enforces UK GDPR and can impose fines of up to £17.5 million or 4% of global annual turnover.