Processing personal data The obligations that the General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR) places on data processors and controllers, including law firms, should be well-known, see Practice Notes: Introduction to the EU GDPR and UK GDPR and How to manage data protection complianceHow to manage data protection compliance. All law firms should know and record what personal data they hold, what they are doing with that data, where and on what basis and what they tell data subjects. The first GDPR data protection principle requires that personal data should be 'processed lawfully, fairly and in a transparent manner in relation to the data subject'. This means, in practice, that in relation to all personal data held by your law firm, you ought to: