As explained in Practice Note: Data protection law—new starter guide, there are a number of distinct data protection laws in the UK. Two of those regimes are: • the UK GDPR regime—United Kingdom’s General Data Protection Regulation, Retained Regulation (EU) 2016/679 (UK GDPR) regime is the primary UK data protection regime and covers most personal data processing in the UK. The UK GDPR regime is supplemented by certain detailed provisions in the Data Protection Act 2018 (DPA 2018) • the law enforcement processing regime—governs the processing of personal data by certain ‘competent authorities’ (eg the police) for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Relevant provisions are primarily found in DPA 2018, Pt 3 (DPA 2018, s 29) For the purpose of this Q&A, it is assumed that: • the relevant organisation that may receive such as request