Under the Data Protection Act 2018, an organisation holding personal data must:
- Publish all the data it holds on a public website
- Keep the data indefinitely in case it is needed
- Keep the data accurate, secure and use it only for the stated purpose
- Sell the data only to approved buyers