In its mission to protect the personal data of European Union (EU) citizens, the reach of the General Data Protection Regulation (GDPR) extends into the research activities traditionally supervised and approved by university institutional review and ethics boards. This article discusses how transnational research for an online support intervention for family carers of people with dementia was obstructed by a particularly restrictive interpretation of the 2018 GDPR. Contested issues discussed include privacy, consent, the balance between risks and benefits, and the rights of family carers.