At the ten-year milestone, how well is the EU’s General Data Protection Regulation (GDPR) achieving its aims? More broadly, how effective is it in safeguarding personal data against a spectrum of recognised and potential threats to individual freedoms and fundamental rights? This anniversary offers a great opportunity to examine what empirical research tells us about data protection in practice and how that knowledge should inform its future.
The European Commission’s Digital Omnibus proposal, presented in November 2025, has brought questions about regulatory simplification, compliance costs and the protection of fundamental rights into renewed focus. In their joint assessment, the European Data Protection Board and European Data Protection Supervisor welcomed aspects of simplification while raising concerns about changes that could weaken protection or create legal uncertainty.
These discussions make a stronger empirical basis for reform particularly important. Which problems are well observed and supported? Who experiences them, and under what circumstances? What evidence supports the expectation that a proposed change will improve outcomes?
From over 1000 publications to 258 empirical evidence entries.
Our team reviewed more than 1000 relevant empirical publications and organised empirical evidence identified into 258 entries for the Data Protection Evidence Wiki.
Join CREATe at 1pm BST on Thursday, 24 September 2026, for the online launch of the Data Protection Evidence Wiki, a resource designed to make empirical research more accessible to those asking these questions.
Event details
- Date: Thursday, 24 September 2026
- Time: 1:00pm-2.30pm (BST)
- Location: Zoom (Online)
- Registration: https://zoom.us/meeting/register/Sel0CwoUSIyW0Qs2ZHqobg
Putting empirical evidence at the centre of reform
Assessing data protection law requires attention to its effects on individuals, organisations and society. Empirical research can help us understand how people exercise their rights, how organisations respond to regulatory requirements, and how data protection influences privacy practices, innovation and digital markets. Reform grounded in empirical evidence requires us to examine both achievements and shortcomings. It also requires careful distinctions between problems arising from legal requirements, their implementation, and their enforcement.
Empirical research cannot settle every question about the values and rights that law should protect. It can, however, help clarify the problems reform seeks to address, test assumptions about how regulation works, and inform assessments of the likely benefits and costs of change. The resource brings together research that would otherwise need to be located across different publications and disciplines. It provides a structured starting point for exploring what has been studied, what researchers have found, and where evidence remains limited.
As debate around the Digital Omnibus and the future of data protection develops, the project seeks to support a more informed discussion: one in which claims about the law’s effects can be examined against empirical findings, and gaps in knowledge can guide further research.
Further background is available on the CREATe project page.
What to expect at the launch
The session will combine an introduction to the project with a practical demonstration and an open discussion. We will:
- Introduce the background of the Data Protection Evidence and explain how the literature was selected and organised into 258 entries.
- Demonstrate how to use the Wiki and visualisation tools to locate empirical evidence relevant to a particular topic.
- Work through an example, moving from a question to relevant research and interpreting its findings in context.
- Discuss how empirical evidence can inform debates about data protection reform, including the questions that existing research cannot yet answer.
- Invite feedback on the resource and suggestions for future development.
Participants are encouraged to bring questions from their own research or professional practice.
Who should attend?
We welcome researchers and students, policymakers and regulators, data protection professionals, civil society organisations, and people working in technology design and business. The event will offer an introduction to the evidence base and an opportunity to discuss its use with the project team.
Join us on 24 September to explore how empirical evidence can inform the next chapter of data protection law.
Funding and acknowledgements
The Data Protection Evidence Wiki is supported by the Economic and Social Research Council (ESRC) IAA and the CREATe’s Arts and Humanities Research Council (AHRC) Research Infrastructure Award. We are grateful for their support in developing this resource and connecting empirical research with policy and practice.
The Data Protection Evidence Wiki builds on our earlier systematic review, Mapping the empirical literature of the GDPR’s (In-)effectiveness: A systematic review, published in Computer Law & Security Review in 2025. The article maps empirical research on EU data protection law and develops a framework for assessing its findings, limitations and implications for evaluating the GDPR. It provides the research context and methodological foundation for the Wiki.