[mywacaday]

Spanish company, how far would they get with a GDPR request? Are security companies exempt?

[ThePowerOfFuet]

The GDPR contains explicit exceptions for police and national security; see Recital 16, Article 23(1), etc.

[toyg]

They were not police, and unless they were directly hired by GCHQ or similar, they were not working for UK natsec either.

[gnud]

I doubt those exceptions cover spying on behalf of a third party who is not party to the GDPR.