As explained in Practice Note: The Data Protection Act 2018, the Data Protection Act 2018 (DPA 2018) addresses: • various permitted national derogations under Regulation (EU) 2016/679, the General Data Protection Regulation (the GDPR) regime (primarily, in Chapter 2 of DPA 2018, Pt 2) (the GDPR Regime) • various processing, which technically falls outside of the GDPR Regime, including: ◦ processing of personal data by law enforcement (DPA 2018, Pt 3) ◦ processing of personal data by intelligence services (DPA 2018, Pt 4) ◦ in DPA 2018, Pt 2, Chapter 3, an ‘applied GDPR’ regime which generally extends certain GDPR derived standards to certain other personal data processing, which is not technically subject to the GDPR Regime For further information, see the Information Commissioner’s Office’s (ICO) page on the Data Protection Act 2018. We assume your query relates to the GDPR Regime (and not law enforcement or intelligence service