Yes, GDPR is still law in the UK - https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

As I understand it, under GDPR data controllers have a responsibility to take reasonable measures to secure the data. I believe failure to do so is a criminal offense.