The energy sector is undergoing a ‘digital revolution’, whereby information and communication technologies (ICTs) are increasingly deployed throughout energy infrastructure, leading to the growing digitization of production, storage and consumption processes. With potentially hundreds of millions of smart meters to be installed in the European Union (EU) and the United States (US) in the coming years, ICTs make it possible to collect and analyze large amounts of complex data to optimize the whole energy system, while providing consumers with a number of customized services. Firms in the energy sector are gradually turning into massive data collectors. As a result, the energy industry is one of the sectors that has been most impacted by the requirements outlined in the EU’s new General Data Protection Regulation (GDPR), launched in May 2018. The GDPR contains a number of strict and far-reaching requirements for firms that process EU citizens’ data. The regulation is explicit that these cover not only EU-based firms, but any company anywhere in the world that processes the data of EU citizens or residents. As a result, the extra-territorial reach of the GDPR is considerable. Since the EU is the first trading partner of the US, many American firms will have to abide by the new rules set out in the GDPR.