Impacts of the Implementation of the General Data Protection Regulations (GDPR) in SME Business Models—An Empirical Study with a Quantitative Design

Understanding challenges of GDPR implementation in business enterprises: a systematic literature review

“…Notably, technology-related industries, such as the IT sector (Pathak et al , 2023; Poritskiy et al , 2019), Fintech (Pathak et al , 2023), software engineering (Leite et al , 2022) and the industrial sector (Freitas and Mira da Silva, 2018), were common subjects of investigation. Regarding geographical dispersion, the dominant countries in the reviewed studies were Germany (Härting et al , 2020; Härting et al , 2021) and Portugal (Freitas and Mira da Silva, 2018; Leite et al , 2022; Poritskiy et al , 2019), indicating that GDPR implementation might be perceived as a complex issue in these economies.…”

“…Leite et al, 2022;Mangini et al, 2020;Pathak et al, 2023), the overall diversity of research methodologies was limited. Therefore, we suggest that more empirical research, such as involving a mixed-methods approach (Härting et al, 2020), is needed to derive quantitatively comparable results and capture the full complexity of the challenges faced by organisations (Martínez-Martínez, 2018;Saniei, 2021;Sirur et al, 2018;Teixeira et al, 2019;Zaman and Hassani, 2019). Secondly, most studies primarily discussed GDPR implementation challenges within the broader context of the EU, providing a more generic perspective.…”

“…Since the legislation's adoption, companies have had to allocate extended budgets for GDPR compliance (Sirur et al, 2018). Besides hiring new professionals, investments are necessary for systems, procedures, standards (Mangini et al, 2020) and cybersecurity (Marotta and Madnick, 2021;Härting et al, 2020) point out various costs involved, including implementation costs, running expenses for external data protection officers, potential revenue losses, opportunity costs and time expenditures. Although larger companies may have financial and human resources to invest in GDPR compliance, the same does not necessarily apply to SMEs (De Carvalho et al, 2020).…”

“…Process adaptation. The GDPR, primarily a legal document, lacks comprehensive technical guidance for its implementers, leading to unforeseen complications in adapting internal processes (Härting et al, 2020;Politou et al, 2018;Sirur et al, 2018). Challenges emerge in operational adaptation towards privacy-aware and compliant business practices (De Carvalho et al, 2020), establishing processes for straightforward data deletion (Poritskiy et al, 2019), and superseding existing work processes (Härting et al, 2021).…”

“…their study, Sirur et al (2018) reported strong criticism about the timing of guidance for SMEs as they lacked a dedicated focus on data protection and felt unequipped to handle the GDPR regulation alone. At the same time, Härting et al (2020) discovered that inadequate information provision by government authorities negatively impacted GDPR implementation among German SMEs. Thus, it follows that the lack of sufficient support from government authorities emerges as a significant challenge for SMEs in their efforts to achieve GDPR compliance.…”