So it is time to take stock of data regulations, and see whether existing measures are having the desired effects and whether a different approach to monitoring and enforcement is merited. It may take more than a spring clean from firms that hold and monetise customer data to avoid more onerous scrutiny around their privacy and security controls.