Working with the Ethics Committee at my university to refine the process for assessing the research proposals coming from the humanities and social sciences. The EU General Data Protection Regulation was implemented in 2018. Two years later we still need a better understanding of how the issues of data protection and privacy should be dealt in fields outside biomedical research, for instance.