This Q&A assumes that the processing activities may be subject to the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) and/or the UK General Data Protection Regulation, Retained Regulation (EU) 2016/679 (UK GDPR) but are not subject to any other data protection regimes (such as the special regime applicable to law enforcement processing). The EU GDPR and UK GDPR Subject to their respective detailed material and territorial scopes, the EU GDPR and the UK GDPR apply to the ‘processing’ of ‘personal data’. In summary, ‘processing’ includes doing almost anything with personal data, including storing, sharing, deleting or using it. For detailed guidance on the meaning of ‘personal data’ and ‘processing’, see Practice Note: Key definitions under data protection