A Framework for Investigating GDPR Compliance Through the Lens of Security | SpringerLink
Skip to main content
Springer Nature Link
Log in

A Framework for Investigating GDPR Compliance Through the Lens of Security

  • Conference paper
  • First Online:
Mobile Web and Intelligent Information Systems (MobiWIS 2021)

Part of the book series: Lecture Notes in Computer Science ((LNISA,volume 12814))

  • 902 Accesses

Abstract

The General Data Protection Regulation (GDPR) was widely seen as a significant step towards enhancing data protection and privacy. Unlike previous legislation, adherence to GDPR required organizations to assume greater responsibility for cybersecurity with respect to data processing. This shift represented a profound transformation in how businesses retain, use, manage, and protect data. However, despite these innovative aspects, the actual implementation of the GDPR security side poses some challenges. This paper attempts to identify positive and negative aspects of GDPR requirements and presents a new framework for analyzing them from a security point of view. Firstly, it provides an overview of the most significant scholarly perspectives on GDPR and cybersecurity. Secondly, it presents a systematic roadmap analysis and discussion of the requirements of GDPR in relation to cybersecurity. Results show that some of the GDPR security controls, such as the Data Protection Impact Assessments (DPIA), records on processing, and the appointment of a Data Protection Officer (DPO), are some of the most critical from a security viewpoint. Finally, it provides recommendations for tackling these challenges in the evolving compliance landscape.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Subscribe and save

Springer+ Basic
¥17,985 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
JPY 3498
Price includes VAT (Japan)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
JPY 5719
Price includes VAT (Japan)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
JPY 7149
Price includes VAT (Japan)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

Notes

  1. 1.

    Case Study #5: Understanding the Compliance Forces that Influence Cybersecurity in the Banking Sector, especially in the UK.

  2. 2.

    The mapping methodology is a research-based method for recording qualitative information, analyzing its distribution, and prioritizing relevant information in relation to a specific topic or research issue.

  3. 3.

    The desirable compliance goal of a GDPR requirement established by the Regulation.

  4. 4.

    Real impact of a GDPR requirement on cybersecurity practices, processes, and behaviors in an organization.

  5. 5.

    The variables can assume the following values: Low = 1, Medium = 2, High = 3, Very High = 4.

  6. 6.

    The GDPR ensures the implementation of three principles of the “CIA triad” (confidentiality, integrity, and availability).

  7. 7.

    According to Article 39, the DPO “shall in the performance of his or her tasks have due regard to the risk associated with processing operations,” including security risk.

  8. 8.

    For example, loss of sensitive personal data, such as medical records, email address, IP address or images.

References

  1. The European Parliament and the Council of the European Union: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (2016)

    Google Scholar 

  2. ICO Security outcomes | ICO. In: ico.org.uk. https://ico.org.uk/for-organisations/security-outcomes/. Accessed 25 Mar 2021

  3. Madnick, S.E., Marotta, A., Novaes Neto, N., Powers, K.: Research Plan to Analyze the Role of Compliance in Influencing Cybersecurity in Organizations (2020)

    Google Scholar 

  4. Marotta, A., Madnick, S.E.: Analyzing the interplay between regulatory compliance and cybersecurity (revised). SSRN Electron. J. (2020). https://doi.org/10.2139/ssrn.3569902

    Article  Google Scholar 

  5. Marotta, A., Madnick, S.: Perspectives on the relationship between compliance and cybersecurity. J. Inf. Syst. Secur. 16, 27 (2021)

    Google Scholar 

  6. Marotta, A., Madnick, S.: Issues in information systems convergence and divergence of regulatory compliance and cybersecurity. 22, 10–50 (2021). https://doi.org/10.48009/1_iis_2021_10-50

  7. Zerlang, J.: GDPR: a milestone in convergence for cyber-security and compliance. Netw. Secur. 2017, 8–11 (2017). https://doi.org/10.1016/S1353-4858(17)30060-0

    Article  Google Scholar 

  8. Tsohou, A., Magkos, E., Mouratidis, H., et al.: Privacy, security, legal and technology acceptance elicited and consolidated requirements for a GDPR compliance platform. Inf. Comput. Secur. 28, 531–553 (2020). https://doi.org/10.1108/ICS-01-2020-0002

    Article  Google Scholar 

  9. Poritskiy, N., Oliveira, F., Almeida, F.: The benefits and challenges of general data protection regulation for the information technology sector. Digit. Policy Regul. Gov. 21, 510–524 (2019). https://doi.org/10.1108/DPRG-05-2019-0039

    Article  Google Scholar 

  10. Horák, M., Stupka, V., Husák, M.: GDPR compliance in cybersecurity software: a case study of DPIA in information sharing platform. In: ACM International Conference Proceeding Series, pp. 1–8. Association for Computing Machinery, New York (2019)

    Google Scholar 

  11. Lachaud, E.: The General Data Protection Regulation and the rise of certification as a regulatory instrument (2018)

    Google Scholar 

  12. Saqib, N., Germanos, V., Zeng, W., Maglaras, L.: Mapping of the security requirements of GDPR and NISD. ICST Trans. Secur. Saf. 166283 (2018). https://doi.org/10.4108/eai.30-6-2020.166283

  13. Diamantopoulou, V., Tsohou, A., Karyda, M.: General Data protection regulation and ISO/IEC 27001:2013: synergies of activities towards organisations’ compliance. In: Gritzalis, S., Weippl, E.R., Katsikas, S.K., Anderst-Kotsis, G., Tjoa, A.M., Khalil, I. (eds.) TrustBus 2019. LNCS, vol. 11711, pp. 94–109. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-27813-7_7

    Chapter  Google Scholar 

  14. Diamantopoulou, V., Tsohou, A., Karyda, M.: From ISO/IEC 27002:2013 information security controls to personal data protection controls: guidelines for GDPR compliance. In: Katsikas, S., et al. (eds.) CyberICPS. LNCS, vol. 11980, pp. 238–257. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-42048-2_16

    Chapter  Google Scholar 

  15. Lopes, I.M., Guarda, T., Oliveira, P.: How ISO 27001 can help achieve GDPR compliance. In: Iberian Conference on Information Systems and Technologies, CISTI. IEEE Computer Society (2019)

    Google Scholar 

  16. Chivot, E., Castro, D.: What the Evidence Shows About the Impact of the GDPR After One Year. Cent. DATA Innov (2019). http://www2.datainnovation.org/2019-gdpr-one-year.pdf. Accessed 25 Mar 2021

  17. GOV.UK. Data protection - GOV.UK. Gov.uk (2014). https://www.gov.uk/data-protection/the-data-protection-act. Accessed 25 Mar 2021

  18. Sutherland, S., Katz, S.: Concept mapping methodology: a catalyst for organizational learning. Eval. Program. Plan. 28, 257–269 (2005). https://doi.org/10.1016/j.evalprogplan.2005.04.017

    Article  Google Scholar 

  19. IAPP, Ernst, Young: IAPP-EY Annual Governance Report 2019 (2019)

    Google Scholar 

  20. Neto, N.N., Madnick, S., Paula, A.M.G.D., Borges, N.M.: Developing a global data breach database and the challenges encountered. J. Data Inf. Qual. 13, 1–33 (2021). https://doi.org/10.1145/3439873

    Article  Google Scholar 

  21. ICO. Information Commissioner’s Annual Report and Financial Statements. ICO (2019)

    Google Scholar 

  22. Marotta, A., Martinelli, F.: GDPR survey: an analysis of the tools used for assessing GDPR compliance. Technical report (IIT B4-05/2020) - IIT CNR (2020)

    Google Scholar 

  23. Vinet, L., Zhedanov, A.: A “missing” family of classical orthogonal polynomials (2011)

    Google Scholar 

  24. Isaak, J., Hanna, M.J.: User data privacy: Facebook, Cambridge analytica, and privacy protection. Comput. (Long Beach Calif.) 51, 56–59 (2018). https://doi.org/10.1109/MC.2018.3191268

    Article  Google Scholar 

Download references

Acknowledgements

The research reported herein was supported in part by the Cybersecurity at MIT Sloan initiative, which is funded by a consortium of organizations, and a gift from C6 bank.

Author information

Authors and Affiliations

  1. MIT Sloan School of Management, 245 First Street, Cambridge, MA, 02142, USA

    Angelica Marotta

  2. MIT Sloan School of Management, 100 Main Street, Cambridge, MA, 02142, USA

    Stuart Madnick

Authors
  1. Angelica Marotta
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Stuart Madnick
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Angelica Marotta .

Editor information

Editors and Affiliations

  1. Concordia University, Montreal, QC, Canada

    Jamal Bentahar

  2. University of Bradford, Bradford, UK

    Irfan Awan

  3. Oxford Brookes University, Oxford, UK

    Muhammad Younas

  4. Kristiania University College, Oslo, Norway

    Tor-Morten Grønli

Rights and permissions

Reprints and permissions

Copyright information

© 2021 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Marotta, A., Madnick, S. (2021). A Framework for Investigating GDPR Compliance Through the Lens of Security. In: Bentahar, J., Awan, I., Younas, M., Grønli, TM. (eds) Mobile Web and Intelligent Information Systems. MobiWIS 2021. Lecture Notes in Computer Science(), vol 12814. Springer, Cham. https://doi.org/10.1007/978-3-030-83164-6_2

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-83164-6_2

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-83163-9

  • Online ISBN: 978-3-030-83164-6

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation