Data Protection Act 2018 (DPA) and the UK GDPR
The GDPR and DPA requires the organisation to ensure appropriate technical and organisational measures are taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of or damage to, personal data.