Impacts of the New General Data Protection Regulation for Small- and Medium-Sized Enterprises

Understanding challenges of GDPR implementation in business enterprises: a systematic literature review

“…This limitation may not fully capture participants' views over an extended period, as research participants' perspectives may change or evolve over time (Mangini et al, 2020). In this regard, Härting et al (2021) and Sirur et al (2018) advocate for investigating the long-term impact of GDPR implementation on organisations to gain a more comprehensive understanding of its effects over time.…”

“…Politou et al (2018) advocated for expanding studies into legal, ethical and social implications of GDPR requirements, while Marotta and Madnick (2021) proposed examining the role of GDPR compliance in the broader context of data governance and data ethics. Additionally, studying the influence of industry support versus government guidance (Sirur et al, 2018) and the effectiveness of support mechanisms for SMEs in GDPR compliance (Härting et al, 2021) deserve focused attention. These research avenues can provide new vision of addressing the challenges of GDPR implementation and ensuring robust data protection measures in organisations.…”

“…The analysis of the literature also showed that researchers exhibited a greater academic interest in studying GDPR implementation challenges faced by small and medium enterprises (SMEs), which were the focus of studies conducted by Freitas and Mira da Silva (2018), Härting et al (2021) and Leite et al (2022). Interestingly, two studies carried out by Poritskiy et al (2019) and Sirur et al (2018) did not only explore SMEs but also examined the challenges faced by large organisations.…”

“…The GDPR, primarily a legal document, lacks comprehensive technical guidance for its implementers, leading to unforeseen complications in adapting internal processes (Härting et al, 2020;Politou et al, 2018;Sirur et al, 2018). Challenges emerge in operational adaptation towards privacy-aware and compliant business practices (De Carvalho et al, 2020), establishing processes for straightforward data deletion (Poritskiy et al, 2019), and superseding existing work processes (Härting et al, 2021). Moreover, identifying data origins, determining necessary information retention, and tracking data activities during data collection pose additional difficulties (Leite et al, 2022).…”

“…While large companies can easily hire new personnel to handle compliance, small companies tend to rely on their own efforts to interpret the legislation and ensure compliance. Due to limited knowledge and expertise in GDPR, SMEs may perceive insufficient practical guidance and lack of support from authorities (Härting et al, 2021;Teixeira et al, 2019). For example, in IJLMA 66,3…”