What are the rules regarding the use of GDPR?

Data must be obtained for a specified and lawful purpose Data must be accurate and kept up to date Data must not be kept for longer than is necessary There must be a system in place to protect/safeguard the data held on employees