GDPR is not loved, but does it work?

Regulations to protect personal data don't inspire much love.Companies frequently regard them as a nuisance, a needless expense, and a hindrance to innovation.Governments think the rules should apply to everyone but themselves.And ordinary people often act as if they don't care about whether their data is safeguarded or not". 1 This opening paragraph in a guest editorial in Foreign Affairs magazine, coinciding with the GDPR application in 2018, might appear remarkably prescient as an analysis, but is in fact an example of the more general challenges facing many contemporary regulatory regimes.Particularly for a law having the reach that GDPR has, it is hugely challenging to address the very broad range of interests of so many different stakeholders within a single regulatory regime.The GDPR, after all, addresses its obligations to tens of millions of organizations (and even individuals) across every sector and activity and grants enforceable rights, including the right to have individual complaints investigated by a