In a year when COVID-19 has stress-tested privacy protections and where mutual recognition of global data protection regimes has been called into doubt, our rights and regulations have ultimately remained resilient. The question is whether and how we rebuild on those foundations.