Understanding Data Protection Regulations from a Data Management Perspective: A Capability-Based Approach to EU-GDPR
Year: 2019
Type: conference-paper
Abstract: The European General Data Protection Regulation (EU-GDPR) hasentered into force in May 2018. Its emphasis on individual control andorganizational accountability constitutes a new paradigm that requires changesin the way organizations manage personal data. However, organizations facedifficulties when implementing EU-GDPR due to a lack of common groundbetween legal and data management domains. Anchored in the resource-basedview theory (RBV), this paper argues that the regulation requires companies tobuild a dedicated data management capability. It presents a capability model thatwas developed in an iterative design science process, integrating bothinterpretation of legal texts and practical insights from focus groups with morethan 30 experts and from 3 EU-GDPR projects. The paper advances theregulatory compliance management literature by translating legal data protectionconcepts for the IS community. It also contributes to practice by enablingorganization to set-up systematic approaches towards EU-GDPR compliance.
Source: SERVAL (Université de Lausanne)
Authors: Clément Labadie, Christine Legner
Language: English
Subfield: Law
Field: Social Sciences
Domain: Social Sciences
Open Access status: green
OpenAlex ID: W2967203918