Everything we do with information about people, such as how we collect it and who we share it with, has to comply with the Data Protection Act and the General Data Protection Regulation (GDPR). A key part of this is being open about how we use information and what rights you have in respect of information we hold about you.