CREATe is happy to present the fourth entry in our series of working papers released in 2025: ‘Mapping the Empirical Literature of the GDPR’s (In-)Effectiveness: A Systematic Review’, by Wenlong Li, Zihao Li, Wenkai Li, Yueming Zhang, Aolan Li. This is the pre-print version of an article forthcoming in Computer Law and Security Review.
Click on image to download.
In the realm of data protection, a striking disconnect prevails between traditional domains of doctrinal, legal, theoretical, and policy-based inquiries and a burgeoning body of empirical evidence. Bridging this gap is particularly important for evaluating the effectiveness of the EU’s General Data Protection Regulation (GDPR) in achieving its stated and anticipated objectives, especially in light of emerging debates on AI regulation and the recent political momentum in Europe calling for a substantial reduction in GDPR-related bureaucratic burdens.
This paper offers a comprehensive and systemic review of empirical research on the EU General Data Protection Regulation (GDPR) from 1995 to March 2022. It bridges the prevalent gap between doctrinal perspectives and empirical evaluations, emphasising that robust empirical analysis is crucial for accurately assessing the effectiveness of data protection law. This synthesis is particularly timely, given the increasing scrutiny of GDPR’s impact, ranging from enforcement actions against major tech firms to broader societal and economic consequences. By categorising empirical evidence into four thematic clusters—Awareness and Trust, Operational Performance, Ripple Effect, and Normative Clarity—the paper provides a structured, multidimensional understanding of GDPR implementation. It highlights the complexity and nuance of GDPR’s practical effects and challenges oversimplified views that rely solely on compliance metrics or enforcement outcomes.
The paper argues for a methodological shift towards coordinated and rigorous empirical research, asserting that empirical findings should directly inform policy reviews, legislative reforms, and doctrinal discussions. It identifies underexplored areas within GDPR research and advocates for greater integration of empirical insights into the broader regulatory and theoretical discourse. By bridging the gap between empirical realities and legal doctrines, this paper enhances the understanding of the practical implications of EU data protection law.
The paper concludes by underscoring the importance of integrating empirical evidence into ongoing policy discussions, particularly as Europe navigates complex debates around AI regulation and contemplates significant reductions in GDPR-related bureaucracy. It emphasises that a more coordinated empirical approach is essential for accurately assessing GDPR’s multifaceted impacts and informing effective regulatory strategies.
Full paper can be downloaded here.