The extent to which intelligence and security services engage in countering state-sponsored economic cyber espionage, and the framework of safeguards applicable to their actions, remains underexplored. The investigatory cyber powers at their disposal often involve the collection and processing of bulk data. While such capabilities are considered essential for identifying national security threats, they also entail significant interference with the right to privacy and data protection. This raises the question of which minimum requirements for privacy and data protection apply when these investigatory powers are used by intelligence and security services against state-sponsored economic cyber espionage. In this research, the author addresses that question by identifying a set of minimum requirements for privacy and data protection in this specific context. The analysis proceeds in five stages: first, examining relevant concepts and developments in the intelligence landscape, particularly regarding the use of investigatory powers against economic cyber espionage; second, identifying minimum requirements for privacy and data protection; third, adapting those requirements to the specific landscape and investigatory powers; and fourth, applying the identified requirements to the framework on the use of investigatory cyber powers by intelligence and security services in the Netherlands. Finally, the author proposes several recommendations.