GDPR rests on a set of core principles: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability, being able to show that the requirements are met.