Less than two months had passed since the General Data Protection Regulation entered into force on 25 May 2018, and yet its impact could already be seen everywhere. In addition to a flood of emails asking for our (renewed) consent, countless new or re-formulated data protection policies “emerged”, while the public debate hailed a “new awareness” in companies regarding data protection. It’s hardly surprising, therefore, that both developments were in the focus of attention at the VII. Interdisciplinary Workshop “Privacy, Data Protection & Surveillance” in July at the Humboldt Institute for Internet and Society (HIIG).