Data, Privacy Laws and Firm Production: Evidence from the GDPR

By regulating how firms collect and use data, privacy laws may alter firm demand for information technology inputs.We study how firms respond to privacy laws in the context of the EU's General Data Protection Regulation (GDPR) by using seven years of data from a global cloud-computing provider.Our difference-in-difference estimates indicate that, in response to the GDPR, EU firms decreased data storage by 26% and data processing by 15% relative to comparable US firms, becoming less "data-intensive."To estimate the costs of the GDPR for firms, we propose and estimate a production function where firms combine data and computation in firm production.We find that data and computation are strong complements and that firm responses are consistent with the GDPR representing a 20% increase in the cost of data.This increase translates into only a 0.1-0.5% rise in overall production costs because data plays a relatively small role in firm production compared to computation.