In November 2016 the Investigatory Powers Act ('IPA') received Royal Assent. IPA was hailed by the Government as bringing the UK’s surveillance framework into the 21st Century and better allowing security and intelligence agencies to combat terrorism and serious crime. IPA raises a range of concerns, with its progress through Parliament marked by sustained opposition from civil liberties groups. One of the most controversial aspects of IPA is the bulk communications data retention and disclosure framework in Parts 3 and 4. This article concerns the compatibility of that framework with EU law in light of CJEU decisions in Digital Rights Ireland ('DRI') and Watson. It will begin by briefly providing some background, will then broadly set out the requirements that can be determined from these decisions, and will proceed to take a more detailed analysis of these requirements in relation to Parts 3 and 4 IPA.