Data privacy laws on paper mean little by themselves , even if they are ubiquitous.(1) It is only through evidence of their enforcement, or through convincing evidence of compliance with them irrespective of enforcement, that we can be satisfied that they cause behavioural change. Evidence of compliance requires large-scale sociological enquiry and is available very rarely. Evidence of enforcement is easier to obtain (though still a non-trivial task), and can be extracted from the records of courts, data protection authorities (DPAs), government agencies, and other authorities responsible for data privacy enforcement, and from nongovernment organisations (NGOs) and academic institutes which keep track of such matters. Cases that are settled before a penalty or compensation verdict is announced will also often have financial settlements that are public, particularly in the US.