Six years ago, the Personal Data Protection Act 2012 (PDPA) came fully into force – a lifetime in technology terms. That period has seen the development of blockchain technology and the rise of artificial intelligence (AI), and the creation, curation, and consumption of personal data has grown at a staggering rate, with 90 percent of all data in the world being generated in the last two years alone. As both technology and business models develop, personal data permeates all aspects of a person's activities; from the location they dial into their Zoom call, to how they interact with online service providers, to the closed-circuit television images capturing their movements around a city.