GDPR
As you are probably aware, the law on data protection in the UK changed on 25th May 2018. The new act, the Data Protection Act 2018, applies the Europe-wide General Data Protection Regulation (GDPR) to the UK. Brexit has not changed this. The new rules are designed to take account of the massive changes in data use since the Data Protection Act 1998. Facebook, smartphones and Google did not exist at the time these rules were created, so the world has changed and the law must do so too.
Please see below relevant documents:
Article 35 Data Protection Impact Assessment (DPIA)