General Data Protection Regulation (GDPR) This is a law that tightens data privacy and has now been implemented in UK law through the introduction of the Data Protection Act 2018. This legislation replaced the Data Protection Act 1998. Personal data must be fairly and lawfully processed Personal data must be obtained for specified, explicit and legitimate purposes Personal data must be adequate, relevant and not excessive Personal data must be accurate and up to date Personal data must not be kept for longer than is necessary Personal data must be handled in a way that ensures security An accountant was found to have thrown old customer records from 2005 in the waste bins outside their office. Which principles of the Act may have been broken?