The Internet of Things (IoT) is one of the most relevant innovations of recent years and stands at the heart of the transition towards a digitised society, due to its ability to gather large amounts of data from millions of connected objects, as well as to process and aggregate them to collect other information. The issues IoT generates mainly concern privacy, the fundamental right to personal data protection, cybersecurity, and liability. After an overview of the current developments and potentials of IoT, the categories of data used within this ecosystem will be analysed. Then, the applicable and inapplicable rules of the GDPR will be highlighted. The conclusions identify the prospect of a protective framework that not only enhances all the tools offered by the GDPR but also goes beyond data protection. This seems necessary because even if such a highly invasive technology can produce very positive effects, the risks it entails cannot be overlooked.