In a new article for the Privacy & Data Protection Journal, Sophie Stalla–Bourdillon and Bárbara da Rosa Lazarotto examine a recent position paper of the Hamburg Supervisory Authority,  which explores the interplay between the GDPR and the Data Act (DA). The Hamburg SA makes three foundational points regarding the interplay between the GDPR and the DA, from which important consequences are drawn: (1) the GDPR takes precedence over the DA; (2) data overviews extending GDPR Records of Processing Activities (‘ROPAs’) should be the starting point for complying with the DA; and (3) GDPR and DA rights can be exercised in parallel. While the Hamburg SA’s position paper is a valuable read — particularly as it draws attention to a legislative file overshadowed by higher-profile instruments like the AI Act — it nonetheless raises three key questions, each with significant implications for the protection of personal data.. The piece is available here.