In a previous article (Floridi 2018), I introduced the distinction between hard and soft ethics. Since the reader may not be familiar with it, let me quickly summarise it here. I will then be able to use it to clarify two issues: the application of soft ethics to the General Data Protection Regulation (henceforth GDPR) and the idea that soft ethics has a dual advantage.