The Data Protection Act 1998 was designed to ensure the fair and lawful processing of the personal data of living individuals and updated previous legislation. It obliges organisations to provide a reasonable degree of confidentiality for information about people, and to respect their privacy. The General Data Protection Regulation, which came into force in May 2018, requires cultural organisations to maintain records of customers who have consented to be contacted with marketing information and what they were advised would happen to their data.
Archives and records are essential for freedom of information and data protection and legislation provides opportunities for improving record keeping by public bodies. Data protection legislation is UK-wide, while freedom of information legislation is devolved to Scotland, but not in Wales.