Five years after the GDPR came into force, the economic literature has examined its economic impact on firms.