The Covid-19 crisis required quick responses from governments and data protection authorities when plans for Track and Trace emerged in various countries. The pandemic highlighted the need for strong privacy protections but also the fact that the GDPR is flexible and adaptable enough to work in such an emergency situation. While contact tracing technologies were at the forefront of many DPAs’ minds, there were also questions about employee monitoring, and using drones and facial recognition for surveillance. Some countries justified drastic measures by “state of emergency” legislation. The general public took an active interest in privacy in many countries at a time when balancing privacy protection with a legitimate need to process health data on a large scale was unprecedented. The DPAs were often in between a stone and a hard place.