The GDPR has not been a success, but something is blowing in the wind. Back in January 2012 the European Commission already acknowledged the need for a reform of the existing Data Protection Directive of 1995. Technology and data processing had progressed at a pace that regulation could not keep up with, threatening citizens’ rights. This state of unrest was supported by key events such as Snowden’s revelations of mass surveillance and the Cambridge Analytica scandal regarding the access of personal information without consent. Europe’s response came in the shape of the GDPR, which promised to bring a breath of fresh air to the stale privacy scene. Given the scope and dependencies of the regulation, there is no simple or unique way of assessing its success (or lack of it). Hence, this essay explores the subject from three perspectives: institutional, corporate, and social; and proposes solutions and recommendations for the future.