This Practice Note considers the privacy and data protection implications of operating a civilian drone (also referred to as an unmanned aerial vehicle or UAV) for commercial and recreational purposes. Among other things, it looks at the provisions of the Air Navigation Order 2016, Retained Regulation (EU) 2018/1139 (the Retained Basic Regulation), Retained Regulation (EU) 2019/947 (the Retained Implementing Regulation), Retained Regulation (EU) 2019/945 (the Retained Delegated Regulation), and the United Kingdom General Data Protection Regulation (UK GDPR) to the use of drones. It also considers issues relating to drone surveillance, and drone-generated data ownership.