On 25 May 2020 the second anniversary of the GDPR was celebrated in many countries. Public and private actors are now turning toward the use of contact tracing solutions as part of the COVID-19 response. GDPR contains appropriate tools to guarantee the effectiveness of these solutions, while ensuring that the principles of effectiveness, necessity and proportionality are respected. It is key that EU citizens trust that their privacy is safeguarded, and privacy rules such as the GDPR play a vital role.