The General Data Protection Regulation (GDPR) is a piece of EU-wide legislation which determines how personal data is processed and kept safe and the legal rights individuals have in relation to their own data. The regulation applies to all schools and still applies even though the UK has left the EU.