Under the DPA98, data always had to be processed lawfully and fairly. Under the GDPR this was uplifted to Lawfully, Fairly and Transparently. This means that organisations have a legal obligation to be open and honest about what personal data they process, for what purpose, under what lawful basis, how long they keep it, who it's shared with, and a host of other things.
