On 25 May 2018, the Data Protection Act entered into full force. The Act implements the EU General Data Protection Regulation (GDPR) in the UK. In particular, the Act requires entities holding and processing personal data to follow "data protection …