The General Data Protection Regulation (GDPR) was finally approved by the European Union, the EU Council and Parliament on 14 April, 2016 and will replace all data protection legislation in EU member states, including the Data Protection Act 1998 (DPA 1998). The new framework aims to put individuals in control of their personal data, and will require schools, academies and any other organisations that process data to put a much stricter focus on data protection.