The critical success factors of GDPR implementation: a systematic literature review

Abstract

Purpose The digital paradigm people live in today, which drastically increased the consumption of data, is a threat to their privacy. To create a high level of privacy protection for its citizens, the European Union proposed the General Data Protection Regulation (GDPR), which introduces obligations for organizations regarding the storing, processing, collecting and disclosing of data. This paper aims to identify the critical success factors of GDPR implementation. Design/methodology/approach A systematic literature review was conducted by following a strict review protocol, where 32 documents were found relevant to perform the review and to answer to the proposed research questions. Findings The critical success factors of GDPR implementation were identified, including barriers and enablers. Furthermore, benefits of complying with GDPR were identified. Research limitations/implications As GDPR is a relatively recent subject, there are still few scientific papers about it. Therefore, the authors were unable to neither identify nor present a robust conclusion regarding specific topics, such as practical outcomes. Originality/value On the basis of the literature, the identified critical success factors may be useful for organizations as these can be better prepared to achieve compliance by prioritizing the enablers and avoiding the barriers.

Factors Determining the Extent of GDPR Implementation Within Organizations: Empirical Evidence From Czech Republic

“…As implied by the nature of the Regulation taken, and even on the basis of some investigations and opinions already published (Khan, 2018;Hoofnagle et al, 2019;Almeida Teixeira et al, 2019), the implementation of GDPR is not supposed to be a short-term one-off activity, but a complex activity that fully becomes the part of any organization that in any way processes personal data -either about customers or about their own employees (Perry, 2019). Garber (2018) also states: "If a business does not have a sufficient overview of its data, this process will disrupt the IT department, compliance team and the business itself.…”

“…By mapping its own data, the organization gets an idea of the overall information flow. Its optimization can lead to lower operational costs (Beckett, 2017;Perry, 2019), more credible data analysis (Garber, 2018;Almeida Teixeira et al, 2019) and, last but not least, increased customer confidence and corporate competitiveness (Beckett, 2017;Almeida Teixeira et al, 2019;Datoo, 2018).…”

“…As mentioned above, the Personal Data Protection Regulation does not precisely define the technological means and procedures that should lead to its successful incorporation (Tankard, 2016;Tamburri, 2020). Based on a broad systematic literature review (Almeida Teixeira et al, 2019) published in the period after the commencement of GDPR, individual articles propose a three-or four-step implementation procedure. Regardless of the number of steps, the individual subframes coincide in the procedure.…”

“…The first and fundamental step is a comprehensive understanding of the organization in terms of structure and continuity of individual data (Almeida Teixeira et al, 2019). Every processing takes place within a certain system framework and therefore it is necessary to take into account the entire data management of the company, all the systems used, the way they are used and the analysis of responsibility for data collection and analysis.…”

“…Although, an universally valid framework (regardless of the number of implementation steps taken) has been identified for any organization to achieve compliance (Almeida Teixeira et al, 2019;Garber, 2018;Tamburri, 2020), each GDPR project takes place in the context of given organization. Therefore, the scope, time frame and cost intensity of the implementation projects are always given by the contextual factors -specifically by characteristics of the selected organization as well as the specifics and circumstances of the implementation itself.…”