For a european perspective; a company I used to work for was in this situation many times over. We worked with law enforcement and the data protection commissio

For a european perspective; a company I used to work for was in this situation many times over. We worked with law enforcement and the data protection commission to ensure zero "pollution" of unrelated information into legal requirements (like subpoenas). If you end up being contacted by law enforcement for data, I'd recommend doing everything you can to help educate them about the information you carry. It might be tempting to volunteer as little as possible, but you also might be the first willing and knowledgeable technical person they've spoken to in some time, and starting a relationship like that on a good foot can be incredibly useful to your company; maybe even you personally. It can mean future requirements get handled without hassle, and may never even come to you at all if they know it's information you don't or can't carry. You can also help shape policy around how such things are handled for others in future. YMMV depending on jurisdiction, but it's worth considering contacts from law enforcement as an opportunity to build a healthy (two way) relationship.