The new Data Protection Act is operational and has been proclaimed since 15th January 2018. It’s here. It’s compulsory.  And there is a criminal offence for directors if companies do not comply.