GDPR as a strategic advantage: trust, churn and loyalty, with the evidence checked

The claim is half right, and the half matters

You will have heard it from a consent platform, a privacy vendor or an agency deck: treat data protection well and customers trust you more, stay longer and buy again. I like the idea. I also notice who usually says it, and what the number underneath it is.

Most of those numbers come from surveys that the seller of a privacy product commissioned, asking people what they would do. That is not worthless. It is just a different thing from what people actually do, and it is a long way from proof that your churn falls.

So this article takes the claim apart and keeps what holds. I use three kinds of evidence, and I say which kind each figure is every time: what adults in Ireland say in public surveys, what people did in controlled experiments, and what happened to real companies. Where the evidence runs out, I show you how to measure the question in your own numbers instead of borrowing someone else's.

The running example is invented. Siobhán runs Corrib Coffee Club in Galway, a monthly coffee subscription at corribcoffee.example. She has 2,000 subscribers paying €18 a month, and after beans, roasting, packaging and postage she keeps €7 of each box. Nobody real, no client.

Worked example: the statistic on Siobhán's desk

A consent platform's sales email lands in Siobhán's inbox. It says a large share of shoppers would leave a brand they did not trust with their data, and that its product therefore cuts churn.

Siobhán asks three questions. Who asked? The vendor. What was asked? What people would do, in a hypothetical. What was measured? Nothing anyone did. So it is an attitude, from someone with something to sell, and it says nothing yet about her 2,000 subscribers.

Three kinds of evidence, and why they are not equal

An attitude survey asks people what they think, feel or would do. A good one, like the national surveys below, uses a sample weighted to match the population, and it tells you honestly what people say. It cannot tell you what they will do at your checkout.

An experiment changes one thing on purpose and watches what people actually do, with a comparison group that did not get the change. That is much closer to cause and effect, but it usually happens in a lab or on one site, with a particular group, and may not carry over to your shop.

Field evidence comes from real companies and real customers, outside a lab: share prices after a data breach, sign ups before and after a law changed. It is real behaviour, but many things change at once, so the researchers have to work hard to isolate the one they care about.

The diagram runs from the top, one question per step about where a number came from. The takeaway is the last box: a figure about other people's customers only becomes a fact about yours when you test it.

Worked example: grading three sentences

First: "Most adults in Ireland say they would trust a company a lot less if it misused their data." An attitude survey. From the regulator's own national survey, it is good context.

Second: "Shoppers shown a clear privacy rating bought more often from the better rated shops." An experiment, if there was a comparison group. Strong, but where and with whom?

Third: "Our clients saw churn fall 30% after installing our banner." A vendor's claim with no comparison group and no way to check it. It goes in the bin.

What adults in Ireland say about trust

The best attitude data in Ireland now comes from the regulator itself. In 2025 the Data Protection Commission (DPC) published its first public attitudes survey, compiled by FleishmanHillard and Empathy Research. It asked 1,034 adults online between 2 and 9 May 2025, with quotas and weighting to match the national population, and gives a margin of error of 3.2 points either way.¹ That is a smaller sample than the big British surveys, so I would not read much into a difference of two or three points.

Asked how data protection law affects them, 53% said it ensures companies use their information responsibly and 47% that it makes their data safer. One in five, 20%, said they do not really know how it affects them, and 19% said it makes being online a nuisance, giving the example of accepting cookies on almost every website.¹

The same survey asked what worries people. The answers are worth a careful look, because they are not what a consent banner vendor would hope.

Each bar is one issue the survey tested, and its height is the share of the 1,034 adults who said they were quite or very concerned about it.¹ The takeaway: the deepest worries are about data going where people did not agree to or do not understand, and about data not being kept safe. The thing a small shop fiddles with most, the tracking behind its ads, comes last of the seven, though still with a majority.

All of this is what people say. It is a fair picture of the mood. It is not a measurement of anyone leaving a shop.

Worked example: what the survey tells Siobhán to do, and not to do

Siobhán had planned to spend a week redesigning her cookie banner as her "trust project". The survey suggests that is not the place to start. Ads based on browsing came last of the seven concerns, and fewer than one in five said the law makes being online a cookie nuisance.

The top concern, children's data, does not touch a coffee club. The next three do. Profiles traded or sold and uses people did not agree to or understand sit at 76% and 74%, so people want to know where their data goes. Data not properly protected sits at 65%, so they want it kept safe. So she reorders her list. First, security basics on the shop and the email platform. Second, a clear page on what she collects, why, and who else handles it. Third, and only then, the banner, because the law requires it to be done properly whatever it does for trust.

What people say and what they do are different things

Researchers call the gap between stated concern and actual behaviour the privacy paradox. Two Irish surveys show it side by side.

In the DPC's survey, three in four adults worried about their data being profiled and sold. Yet only 19% said they pay a lot of attention to how organisations use their personal data, 56% said some but not a lot, and 24% hardly any or none at all.¹ The Central Statistics Office (CSO) asks about behaviour, though still as self reports. In its 2025 household survey of internet users aged 16 and over, only 33% said they read privacy policy statements before providing personal information online. In the same survey, 67% said they restricted the use of their personal data for advertising and 46% that they changed browser settings to prevent or limit cookies.² Put together: people worry a lot, read little, and take the quick action that sits right in front of them.

No Irish survey I found asks why people skip the notices. The UK regulator's 2026 survey did: of British adults who rarely or never read privacy or cookie notices, 64% said they are too long and 29% that the language is too complex.³ That is a UK figure, so treat it as a hint for Ireland, not a measurement.

Worked example: Siobhán's privacy page

Siobhán's template privacy policy runs to about 3,000 words. If the CSO numbers hold for her customers, about two in three will never read it before signing up, and if the British reasons carry over, length is the main one.

She keeps the full policy, because the law expects the full information to be available, and adds a short summary at the top, in plain words: what she collects (name, address, email, payment handled by her card processor), why (to send coffee and to email about the subscription), who else handles it (her card processor, courier and email platform), and how long she keeps it. The point is not to win over people who will never read it. It is to make the page usable for those who do, which is also what the law asks.

What the experiments show: privacy information can change purchases

The cleanest evidence that privacy can affect buying comes from an experiment at Carnegie Mellon University in Pittsburgh. Janice Tsai, Serge Egelman, Lorrie Cranor and Alessandro Acquisti built a shopping search engine that showed a compact privacy rating next to each retailer. When shoppers could see that information, they tended to buy from the retailers that protected their privacy better, and some paid a premium to do it.⁴

The details matter. Participants made real purchases with their own cards, of products that averaged about $15 including shipping. For batteries, 47.4% of purchases in the group that saw privacy ratings went to high privacy sites, against 5.6% in the group that saw no rating, and participants spent an average of 59 cents more on batteries from better rated vendors.⁵

That is real behaviour, with a comparison group, which makes it strong. It is also one lab, in one American city, in 2011, with a rating shown right at the moment of choice. The honest reading: when privacy is visible and easy to compare at the point of purchase, some people will choose it and pay a little for it. It does not say that a privacy policy nobody sees moves anything.

Worked example: making privacy visible at Siobhán's checkout

The lesson Siobhán takes is about where, not whether. The experiment worked because the information sat right next to the decision.

So on her sign up page, next to the email field, she adds one line: "I use your email for your subscription and, if you tick the box, a monthly roast note. Unsubscribe in one click." She does not write "I never share your data", because that is not true. Her courier, her card processor and her email platform all handle it on her behalf, and her privacy notice has to say so.

She does not promise herself a conversion lift from it. The section on churn below shows why one small test rarely proves much.

Where trust breaks: breaches and the field evidence

If there is one place where privacy and customer behaviour are clearly linked, it is when things go wrong. Asked what would happen if an organisation was found to have misused personal data, 64% of adults in the DPC's survey said they would trust it a lot less and 31% a little less. Only 4% said it would make no difference.¹ That is still what people say, about a hypothetical, but it is the mechanism in one question.

The field evidence comes from Kelly Martin, Abhishek Borah and Robert Palmatier, in the Journal of Marketing. They ran three studies. In experiments, merely having access to someone's personal data raised feelings of violation and lowered trust. In an event study of data security breaches at 414 public companies, breaches hurt the firms' performance and even spilled over to rivals. And in a field study with real customers of 15 companies, violation and trust carried the effect of data vulnerability through to outcomes. Their central finding is the useful one: transparency and control in how a firm manages data suppressed those negative effects.⁶

Put together, the evidence supports a narrower and sturdier claim than the vendor version. Good data protection does not reliably make people love you. It does limit how much damage you take when data worries arise, and they arise for everyone sooner or later.

Worked example: a lost laptop at Corrib Coffee Club

Suppose Siobhán's part time packer leaves a laptop on the train to Dublin, with a spreadsheet of 400 subscriber names and addresses on it. No payment details, no passwords.

Scenario one: the spreadsheet was unnecessary, unencrypted, and Siobhán's customers learn about it from a forum post. Scenario two: the laptop was encrypted, the spreadsheet only held what packing needed, and Siobhán emails the 400 people the same week, saying what happened, what was on it, what it means for them, and what she has changed.

The research gives no number for the difference, but it says which one fits "transparency and control". Scenario two also fits the law. A breach has to be reported to the supervisory authority, the DPC in Ireland, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms.⁷ Whether 400 names and addresses on an encrypted laptop clears that bar is a judgement she makes with the DPC's guidance open, not with a vendor's blog.

The churn claim: nobody has proven it for you, so measure it

I looked for public, primary evidence that better data protection directly lowers subscription churn, and found none I would put my name to. The surveys show trust and worry, the experiment shows choices at a checkout, the field study shows damage limitation. None measures churn falling because a business improved its privacy.

That does not make the idea wrong. It makes it something to measure, with three pieces of maths: the churn rate, what churn does to a customer's value, and how many customers you need before a difference is real.

The churn rate is a simple rate, the customers lost in a period divided by the customers you had at the start:

$$c = \frac{L}{N}, \qquad r = 1 - c$$

Here $c$ is the churn rate for the period, $L$ is the number of customers who left during it, $N$ is the number of customers at the start of it, and $r$ is the retention rate, the share who stayed. Foundations: ratios and rates

Churn matters because it compounds into the value of each customer. A common formula for customer lifetime value with a steady margin and retention is:

$$CLV = M \times \frac{r}{1 + d - r}$$

Here $CLV$ is the customer lifetime value, $M$ is the margin a customer brings each period (margin, not revenue), $r$ is the retention rate per period, and $d$ is the discount rate per period, which accounts for money later being worth less than money now. Foundations: lifetime value

Worked example: what one point of churn is worth to Siobhán

Siobhán keeps $M = €7$ a month per subscriber. Her monthly churn is 8%, so $r = 0.92$. She uses a monthly discount rate of $d = 0.01$.

$$CLV = 7 \times \frac{0.92}{1 + 0.01 - 0.92} = 7 \times \frac{0.92}{0.09} = 71.56$$

Every symbol is as before: $M = 7$, $r = 0.92$, $d = 0.01$, and the result $CLV$ is about €71.56 per subscriber. Foundations: lifetime value

If churn fell by one percentage point to 7%, retention would be $r = 0.93$:

$$CLV = 7 \times \frac{0.93}{1 + 0.01 - 0.93} = 7 \times \frac{0.93}{0.08} = 81.38$$

Again $M = 7$ and $d = 0.01$, now with $r = 0.93$, giving a $CLV$ of about €81.38. Foundations: lifetime value

That one point of churn is worth about €9.82 per subscriber, or roughly €19,600 across 2,000 subscribers. So the question is worth asking. The next question is whether she could ever tell if her privacy work caused it.

Worked example: could Siobhán detect it?

Siobhán runs a test. Half of new subscribers get the old account page. The other half get a new one with a clear preferences page, a one click export of their order history and a plain "delete my account" button. After a month, she compares churn.

Say 1,000 subscribers in each group, with 80 leaving from the old page (8%) and 70 from the new one (7%). The test for a difference between two proportions is:

$$z = \frac{p_1 - p_2}{\sqrt{p(1 - p)\left(\frac{1}{n_1} + \frac{1}{n_2}\right)}}$$

Here $z$ is the test statistic, $p_1$ and $p_2$ are the churn rates in the two groups, $p$ is the pooled churn rate across both groups, and $n_1$ and $n_2$ are the group sizes. A $z$ beyond about 1.96 either way is significant at the usual 5% level. Foundations: hypothesis tests

The pooled rate is $p = 150 / 2{,}000 = 0.075$. The bottom of the fraction is $\sqrt{0.075 \times 0.925 \times 0.002} = 0.0118$. So $z = 0.01 / 0.0118 = 0.85$. That is nowhere near 1.96. A one point difference on 1,000 subscribers a side could easily be chance.

How many would she need? The usual sample size formula for comparing two proportions is:

$$n = \frac{(z_{\alpha/2} + z_{\beta})^2 \left[p_1(1 - p_1) + p_2(1 - p_2)\right]}{(p_1 - p_2)^2}$$

Here $n$ is the number needed in each group, $z_{\alpha/2}$ is 1.96 for a 5% significance level, $z_{\beta}$ is 0.84 for 80% power (the chance of spotting a real effect), and $p_1$ and $p_2$ are the two churn rates she wants to tell apart. Foundations: sample size

With $p_1 = 0.08$ and $p_2 = 0.07$, the top is $2.8^2 \times (0.0736 + 0.0651) = 7.84 \times 0.1387 = 1.087$, and the bottom is $0.01^2 = 0.0001$. So $n$ is about 10,900 per group, nearly 22,000 new subscribers in total. Siobhán gets about 300 a month. She cannot prove this effect in her own shop in any reasonable time.

That is the honest conclusion for most small businesses. You can do the privacy work for the reasons that are solid, the law, the damage limitation and simple decency, and track churn alongside it. You should not budget for it as a churn cure, and you should be suspicious of anyone selling it as one. If you want to go deeper on churn itself, I have written about survival analysis, churn and lifetime value and how much data you actually need for a test like this.

The costs are real too

A fair article on strategic advantage has to count the cost side, and the research does.

Carl Benedikt Frey and Giorgio Presidente, at Oxford, compared firms with different exposure to EU markets before and after the GDPR was enforced in 2018. They found the regulation harmed the profitability of companies targeting European consumers through higher costs, with the main burden on smaller companies.⁸

Guy Aridor, Yeon Koo Che and Tobias Salz studied an online travel intermediary and found that the GDPR's opt in requirement led to a 12.5% drop in the consumers the business could observe. The consumers who remained were trackable for longer, and their average value to advertisers went up, which offset some of the loss.⁹ That is field evidence of real behaviour: a meaningful minority say no when asked properly.

Neither study says privacy is bad for business. Together they say it has a price, that the price falls hardest on small firms, and that the customers who do agree to be tracked may be worth more than before.

Worked example: Siobhán's analytics after a proper banner

Before she fixed her banner, Siobhán's analytics recorded 20,000 visits a month, because tracking ran whether people agreed or not. Once the banner asks properly, suppose 12.5% fewer visitors are recorded, the share Aridor and colleagues found in their data. Her recorded visits fall to $20{,}000 \times 0.875 = 17{,}500$.

Her sales have not changed, only the measurement. Without knowing this, she would think her marketing broke. So she writes a note in her reporting on the day the banner changes, and compares conversion rates on consented visits only. I go further into this in event tracking and consent mode.

What the law actually asks of an Irish business

You will often read that the GDPR applies to anyone handling data of EU citizens. That is not quite right. In Ireland the rules are the EU General Data Protection Regulation (GDPR) itself, with the Data Protection Act 2018 setting up the DPC and filling in the Irish detail.¹⁰ The GDPR applies to organisations established in the EU, and to those outside it that offer goods or services to people in the EU or monitor their behaviour there. It turns on where people are, not their citizenship.¹¹

The core is seven principles: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability, which means being able to show you comply.¹² Three rules matter most for the trust argument.

Information has to be given "in a concise, transparent, intelligible and easily accessible form, using clear and plain language".¹³ That includes the purposes and legal basis, the recipients or categories of recipients, how long you keep the data, people's rights, and their right to complain to a supervisory authority, which for an Irish shop means the DPC.¹⁴ Where you rely on consent, "It shall be as easy to withdraw as to give consent."¹⁵

The higher maximum fine under the GDPR is €20 million or 4% of worldwide annual turnover for the preceding financial year, whichever is higher.¹⁶

Two more points a small Irish business should know. The GDPR says plainly that "The controller shall facilitate the exercise of data subject rights", so a request to see, correct or delete data should be easy to make and easy to find.¹³ And Ireland has no cookie exemption for statistics. Under regulation 5 of the ePrivacy Regulations 2011, only cookies needed to carry a communication and those strictly necessary for a service the visitor asked for are exempt. The DPC's guidance puts the question "Do analytics cookies require consent?" and answers "Yes", while adding that first party analytics cookies are unlikely to be a priority for its enforcement.¹⁷

Worked example: Siobhán's sign up form, line by line

Siobhán's old form had one box: "I agree to the terms and to receive marketing". She splits it.

The subscription itself needs her name, address and email to deliver coffee, so that is a contract, and needs no tick box. The roast note email is marketing, so it gets its own unticked box, with one line saying what it is. The privacy notice link sits next to the button. Unsubscribing is one click in every email, because withdrawing must be as easy as agreeing.

Her analytics now waits for consent, the same as anything that feeds advertising, because Ireland has no statistics exemption. That is part of the 12.5% gap she already planned for. And her contact page now has a short form titled "A question or request about your data", which goes to an inbox she checks weekly, while her notice tells people they can also complain to the DPC. I cover the design side in rebuilding email capture for consent and in GDPR dark patterns.

Putting it together: privacy that earns its keep

So where does the strategic advantage sit? Not in a promise of lower churn, which nobody has shown. It sits in four sturdier things: you are visible where the decision is made, you are understandable to the many who never read notices, you limit the damage when something goes wrong, and you stay on the right side of a law that has real teeth.

The diagram reads from the top. The early steps, security and transparency, are the ones the evidence supports most, because they limit the damage when trust is tested. The decision near the end is the honest one: test only what your numbers can detect.

Vetting suppliers deserves its own article, and it has one: how data processors can get you fined.

Worked example: Siobhán's quarter

In the first month Siobhán lists her data, finds an old spreadsheet export from 2022 with 1,400 former subscribers' addresses, and deletes it. She turns on encryption for the packing laptop. In the second month she writes the short privacy summary, splits the sign up form and adds the data request form. In the third month she adds the export and delete buttons to the account page.

She does not run the churn test, because the maths says she would need about 22,000 new subscribers to detect one point. She does keep a monthly churn chart, with a note on the date each change went live. If churn falls, she will not claim it was the privacy work. If a supplier ever has a breach, she will be glad she did it anyway.

That is the version of "GDPR as a strategic advantage" I will stand behind. Not a growth hack. A business that is easy to understand, careful with what it holds and honest when it goes wrong, which is, as it happens, also what people told the DPC they worry about most.

Footnotes

1. FleishmanHillard and Empathy Research for the Data Protection Commission, Public Attitudes Survey, DPC, May 2025, https://www.dataprotection.ie/sites/default/files/uploads/2025-06/DPC_Public_Attitudes_Report_May_2025_updated.pdf

2. Central Statistics Office, Household Internet Security 2025: key findings, CSO, 19 December 2025, https://www.cso.ie/en/releasesandpublications/ep/p-isshisi/householdinternetsecurity2025/keyfindings/

3. Savanta for the Information Commissioner's Office (UK), Public Attitudes on Information Rights Survey 2026, ICO, 2026, https://ico.org.uk/media2/ro2jpfio/ico-public-attitudes-on-information-rights-survey-2026.pdf

4. Janice Y. Tsai, Serge Egelman, Lorrie Cranor and Alessandro Acquisti, The Effect of Online Privacy Information on Purchasing Behavior: An Experimental Study, Information Systems Research, volume 22, issue 2, pages 254 to 268, 2011, https://ideas.repec.org/a/inm/orisre/v22y2011i2p254-268.html

5. INFORMS, Online consumers willing to pay premium for net privacy, says study in INFORMS journal, EurekAlert, July 2011, https://www.eurekalert.org/news-releases/748060

6. Kelly D. Martin, Abhishek Borah and Robert W. Palmatier, Data Privacy: Effects on Customer and Firm Performance, Journal of Marketing, volume 81, issue 1, pages 36 to 58, 2017, https://doi.org/10.1509/jm.15.0497

7. Regulation (EU) 2016/679, General Data Protection Regulation, Article 33, Notification of a personal data breach to the supervisory authority, EUR-Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

8. Chinchih Chen, Carl Benedikt Frey and Giorgio Presidente, Privacy Regulation and Firm Performance: Estimating the GDPR Effect Globally, Oxford Martin School, published in Economic Inquiry, volume 62, issue 3, 2024, https://www.oxfordmartin.ox.ac.uk/publications/privacy-regulation-and-firm-performance-estimating-the-gdpr-effect-globally/

9. Guy Aridor, Yeon Koo Che and Tobias Salz, The Effect of Privacy Regulation on the Data Industry: Empirical Evidence from GDPR, NBER Working Paper 26900, 2020, revised 2022, https://www.nber.org/papers/w26900

10. Data Protection Act 2018 (Number 7 of 2018), long title and section 10, Revised Acts, Law Reform Commission, https://revisedacts.lawreform.ie/eli/2018/act/7/revised/en/html

11. Regulation (EU) 2016/679, General Data Protection Regulation, Article 3, Territorial scope, EUR-Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

12. Regulation (EU) 2016/679, General Data Protection Regulation, Article 5, Principles relating to processing of personal data, EUR-Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

13. Regulation (EU) 2016/679, General Data Protection Regulation, Article 12(1) and 12(2), Transparent information, communication and modalities for the exercise of the rights of the data subject, EUR-Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

14. Regulation (EU) 2016/679, General Data Protection Regulation, Article 13, including 13(2)(d), Information to be provided where personal data are collected from the data subject, EUR-Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

15. Regulation (EU) 2016/679, General Data Protection Regulation, Article 7(3), Conditions for consent, EUR-Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

16. Regulation (EU) 2016/679, General Data Protection Regulation, Article 83(5), General conditions for imposing administrative fines, EUR-Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

17. Data Protection Commission, Guidance note on cookies and other tracking technologies, including regulation 5 of S.I. No. 336 of 2011, DPC, April 2020, https://www.dataprotection.ie/sites/default/files/uploads/2020-04/Guidance%20note%20on%20cookies%20and%20other%20tracking%20technologies.pdf