  The General Data Protection Regulation (GDPR) remains the gold standard in
privacy and security regulation. We investigate how the cost and effort
required to implement GDPR is viewed by workers who have also experienced the
regulations' benefits as citizens: is it worth it? In a multi-stage study, we
survey N = 273 & 102 individuals who remained working in the same companies
before, during, and after the implementation of GDPR. The survey finds that
participants recognise their rights when prompted but know little about their
regulator. They have observed concrete changes to data practices in their
workplaces and appreciate the trade-offs. They take comfort that their personal
data is handled as carefully as their employers' client data. The very people
who comply with and execute the GDPR consider it to be positive for their
company, positive for privacy and not a pointless, bureaucratic regulation.
This is rare as it contradicts the conventional negative narrative about
regulation. Policymakers may wish to build upon this public support while it
lasts and consider early feedback from a similar dual professional-consumer
group as the GDPR evolves.
