https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re... for example. (Yes I know about Brexit, but this is basically identical to when the UK was in the EU and subject to the Directive)