The Data Protection Act (DPA) of 1998 was radically updated in 2018 and since then there has been much media coverage about the General Data Protection Regulation (GDPR). Recent headlines have featured well known organisations that have been fined under the DPA 1998. This article describes the recent changes in data protection law, including the principles behind the DPA and GDPR, highlights patients’ rights and how nurses can advocate for the protection of patients’ personal data, and outlines nurses’ role in ensuring that the principles of data protection are implemented fully as part of patient care delivery.