This policy brief argues that the General Data Protection Regulation (GDPR) should be refocused on the duty of loyalty in data relationships. This would allow a much-needed simplification of the Artificial Intelligence Act (AI Act). The purpose is to establish a regulatory focus on addressing the data power wielded by powerful entities online, while improving competitiveness. This can be achieved by the light-touch regulation of data processing entities that do not pose a significant risk to democracy and rights. The duty of loyalty requires that anybody processing personal data must act in the best interests of the people who may be affected by that processing. The higher the risk related to data processing, the greater the regulatory demands posed by the duty of loyalty. Such an approach would allow regulatory attention to focus on data power in the infosphere. Entities that hold such power should face strict duties and clear prohibitions; those that do not should meet only proportionate requirements.