The UK currently adheres to the UK Data Protection Act 1998. However, this will be superseded by the much tougher GDPR despite Brexit; which was agreed in December 2015 in Brussels. It is imperative that all businesses (whatever the size) who control or process personal data understand the implications and requirements they MUST update or adopt to be fully compliant or face bankruptcy fines.