Plus ça change, plus c’est la même chose. This famous sentence of the French writer and journalist Alphonse Karr (1808–90) describes well the impact of the EU General Data Protection Regulation (‘GDPR’) that entered into force in May 2016 and became applicable two years later. This regulation built much on existing legislation, especially the Data Protection Directive 95/46/EC, and the case-law of the Court of Justice of the European Union (‘CJEU’ or ‘Court’) relating to it. In many cases, the interpretation of the GDPR coincides with that of the directive. This said, the GDPR represents, both quantitatively and qualitatively, a major development in EU data protection law. It constitutes a directly applicable, comprehensive and up-to-date legislative framework for the protection of the fundamental rights of individuals to privacy and data protection as set out, respectively, in Articles 7 (right to private and family life) and 8 (right to the protection of personal data) the Charter of Fundamental Rights of the European Union (‘Charter’), in a field undergoing constant and unforeseeable developments.