The 8 principles: Personal data must be fairly and lawfully processed, Personal data must be obtained for specified and lawful purposes, personal data must be adequate, relevant and not excessive, Personal data must be accurate and up to date, Personal data must not be kept for longer than necessary, Personal must be processed in line with our rights, Personal data must be held securely, Personal data must not be transferred to other countries outside of the European Area