The Data Protection Act 2018 is based on seven key principles. These principles are:

1. Lawfulness, fairness, and transparency
2. Purpose limitation
3. Data minimization
4. Accuracy
5. Storage limitation
6. Integrity and confidentiality (security)
7. Accountability

These principles guide how personal data should be processed by organizations, ensuring that data is handled lawfully, transparently, securely, and with respect to individuals' rights.