The General Data Protection Regulation 2016 (GDPR) and The Data Protection Act 2018, both came into force on 25 May 2018. The Glasgow School of Art’s Data Protection Policy is available here.