GDPR is based on several key principles: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. These principles ensure that personal data is processed in a secure and responsible manner.