Under the GDPR, the data protection principles set out the main responsibilities for BCO. The principles under the GDPR are broadly similar to those in the Data Protection Directive 95/46/EC.