This article examines the interplay between the General Data Protection Regulation and the rules for access to consumer data introduced by the Recast Electricity Directive (2019/944). It brings insights from practice regarding the complexities of applying these two legal frameworks simultaneously by analysing a case from the Dutch electricity market. The case is constructed around a court decision that led Dutch distribution system operators to stop sharing consumers’ ‘personal data with suppliers for the purposes of preparing ‘personalised offers’. The article extracts lessons that can help EU member states when laying down or revising existing legal frameworks for access to consumer data on two main fronts: substantial alignment between data protection legislation and electricity market legislation, and the importance of strengthening cooperation between data protection authorities and energy regulators.