A Framework for Investigating GDPR Compliance Through the Lens of Security

Marotta, Angelica; Madnick, Stuart E.

doi:10.1007/978-3-030-83164-6_2

Cited by 4 publications

(9 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For instance, Härting et al (2020) suggested exploring the impact of GDPR implementation on the broader regulatory environment for SMEs. Politou et al (2018) advocated for expanding studies into legal, ethical and social implications of GDPR requirements, while Marotta and Madnick (2021) proposed examining the role of GDPR compliance in the broader context of data governance and data ethics. Additionally, studying the influence of industry support versus government guidance (Sirur et al, 2018) and the effectiveness of support mechanisms for SMEs in GDPR compliance (Härting et al, 2021) deserve focused attention.…”

Section: Methodological and Theoretical Underpinnings Of Future Researchmentioning

confidence: 99%

“…Conceptual studies, by their nature, involved in-depth discussions based on scholarly perspectives and thorough analysis of legal documents. One of these conceptual studies also used a mapping methodology, for example, the approach adopted by Marotta and Madnick (2021).…”

Section: Overview Of Included Studiesmentioning

confidence: 99%

“…3.2.2 Legal challenges. In a continuously evolving landscape of GDPR compliance, organisations encounter legal complexities (Marotta and Madnick, 2021) that require diligent attention. As legal texts and documents often possess an open-textured nature accommodating diverse interpretations, seeking guidance from legal professionals becomes crucial (Saniei, 2021) to ensure accurate and precise GDPR interpretation and its implementation.…”

Section: Classification Of General Data Protection Regulation Challengesmentioning

confidence: 99%

“…Since the legislation's adoption, companies have had to allocate extended budgets for GDPR compliance (Sirur et al, 2018). Besides hiring new professionals, investments are necessary for systems, procedures, standards (Mangini et al, 2020) and cybersecurity (Marotta and Madnick, 2021;Härting et al, 2020) point out various costs involved, including implementation costs, running expenses for external data protection officers, potential revenue losses, opportunity costs and time expenditures. Although larger companies may have financial and human resources to invest in GDPR compliance, the same does not necessarily apply to SMEs (De Carvalho et al, 2020).…”

Section: Organisational Challengesmentioning

confidence: 99%

“…De Carvalho et al (2020),Kutyłowski et al (2020),Mangini et al (2020),Marotta and Madnick (2021),Pathak et al (2023),Politou et al (2018) andZaman and Hassani (et al (2021),Mangini et al (2020),Marotta and Madnick (2021), Martínez-Martínez (2018), Pathak et al Lack of knowledge, expertise and experience Härting et al (2020), Härting et al (2021), Poritskiy et al (2019) and Teixeira et al De Carvalho et al (2020), Freitas and Mira da Silva (2018), Härting et al (2020), Härting et al (2021), Mangini et al (2020), Marotta and Madnick (2021), Sirur et al (2018) and Teixeira et al (2019) Process adaptation Adaptation of internal processes Establishing new procedures De Carvalho et al (2020), Härting et al (2020), Härting et al (2021), Kutyłowski et al (2020), Leite et al (2022), Poritskiy et al (2019), Politou et al (2018), Sirur et al (2018) and Zaman and Hassani (2019) Corporate governance Resistance to change, culture of privacy, systems/policy change, risk management models Martínez-Martínez (2018), Pathak et al (2023), Poritskiy et al (2019) and Teixeira et al Carvalho et al (2020), Leite et al (2022), Pathak et al (2023) and Politou et al et al (2020), Freitas and Mira da Silva (2018), Mangini et al (2020), Marotta and Madnick (2021), Pathak et al (2023), Sirur et al (2018), Saniei (2021) and Teixeira et al (2019) Insufficient government support Incomplete or vague guidelines and little support from authorities Härting et al (2020), Härting et al (2021), Sirur et al (2018) and Teixeira et al (2019)…”

mentioning

confidence: 99%

See 4 more Smart Citations

Understanding challenges of GDPR implementation in business enterprises: a systematic literature review

Smirnova,

Travieso-Morales

2024

IJLMA

View full text Add to dashboard Cite

Purpose The general data protection regulation (GDPR) was designed to address privacy challenges posed by globalisation and rapid technological advancements; however, its implementation has also introduced new hurdles for companies. This study aims to analyse and synthesise the existing literature that focuses on challenges of GDPR implementation in business enterprises, while also outlining the directions for future research. Design/methodology/approach The methodology of this review follows the preferred reporting items for systematic reviews and meta-analysis guidelines. It uses an extensive search strategy across Scopus and Web of Science databases, rigorously applying inclusion and exclusion criteria, yielding a detailed analysis of 16 selected studies that concentrate on GDPR implementation challenges in business organisations. Findings The findings indicate a predominant use of conceptual study methodologies in prior research, often limited to specific countries and technology-driven sectors. There is also an inclination towards exploring GDPR challenges within small and medium enterprises, while larger enterprises remain comparatively unexplored. Additionally, further investigation is needed to understand the implications of emerging technologies on GDPR compliance. Research limitations/implications This study’s limitations include reliance of the search strategy on two databases, potential exclusion of relevant research, limited existing literature on GDPR implementation challenges in business context and possible influence of diverse methodologies and contexts of previous studies on generalisability of the findings. Originality/value The originality of this review lies in its exclusive focus on analysing GDPR implementation challenges within the business context, coupled with a fresh categorisation of these challenges into technical, legal, organisational, and regulatory dimensions.

show abstract

Section: Methodological and Theoretical Underpinnings Of Future Researchmentioning

confidence: 99%

Section: Overview Of Included Studiesmentioning

confidence: 99%

Section: Classification Of General Data Protection Regulation Challengesmentioning

confidence: 99%

Section: Organisational Challengesmentioning

confidence: 99%

mentioning

confidence: 99%

See 3 more Smart Citations

Understanding challenges of GDPR implementation in business enterprises: a systematic literature review

Smirnova,

Travieso-Morales

2024

IJLMA

View full text Add to dashboard Cite

show abstract

Towards Cyber Security Regulation of Software in the European Union

Lodder,

Toet

2024

Law, Governance and Technology Series

View full text Add to dashboard Cite

How Suboptimal is Work-From-Home Security in IT/ICS Enterprises? A Strategic Organizational Theory for Managers

Pal

Sequeira²,

Zhu

et al. 2023

ACM Trans. Manage. Inf. Syst.

View full text Add to dashboard Cite

The COVID-19 pandemic (e.g., especially the first and second COVID waves) had forced firms (organizations) to radically shift a considerable (if not all) proportion of their employees to serve in a work-from-home (WFH) mode. Industry statistics showcase that despite ushering in significant work-flexibility (and other) benefits, the WFH mode has also expanded an organization’s cyber-vulnerability space, and increased the number of cyber-breaches in IT and IT-OT systems (e.g., ICSs). This leads us to an important fundamental question: is the WFH paradigm detrimental to IT and IoT-driven ICS security in general? While vulnerability reasoning and empirical statistics might qualitatively support an affirmative answer to this question, a rigorous, practically motivated, and strategic cost-benefit analysis is yet to be conducted to establish in principle whether and to what degree WFH-induced cyber-security in an IT/ICS system is sub-optimal when compared to that in the non-WFH work mode. We propose a novel and rigorous strategic method to dynamically quantify the degree of sub-optimal cyber-security in an IT/ICS organization of employees, all of whom work in heterogeneous WFH “siloes”. We first derive as benchmark for a WFH setting - the centrally-planned socially optimal aggregate employee effort in cyber-security best practices at any given time instant. We then derive and compute (using Breton’s Nash equilibrium computation algorithm for stochastic dynamic games) for for the same setting - the distributed time-varying strategic Nash equilibrium amount of aggregate employee effort in cyber-security. The time-varying ratios of these centralized and distributed estimates quantify the free riding dynamics, i.e., a proxy concept for security sub-optimality, within an IT/ICS organization for the WFH setting. We finally compare the free-riding ratio between WFH and non-WFH work modes to gauge the (possible) extent of the increase (lower bound) in security sub-optimality when the organization operates in a WFH mode. We counter-intuitively observe through extensive real-world-trace-driven Monte Carlo simulations that the maximum of the time-dependent median increase in the related security sub-optimality ranges around 25% but decreases fast with time to near 0% (implying security sub-optimality in the WFH mode equals that in the non-WFH mode) if the impact of employee security effort is time-accumulative (sustainable) even for short time intervals.

show abstract

A Framework for Investigating GDPR Compliance Through the Lens of Security

Cited by 4 publications

References 16 publications

Understanding challenges of GDPR implementation in business enterprises: a systematic literature review

Understanding challenges of GDPR implementation in business enterprises: a systematic literature review

Towards Cyber Security Regulation of Software in the European Union

How Suboptimal is Work-From-Home Security in IT/ICS Enterprises? A Strategic Organizational Theory for Managers

Contact Info

Product

Resources

About