Farhad Fatehi (University of Queensland), Andrew Burton-Jones (University of Queensland), Andrew Hynd, Farkhondeh Hassandoust (University of Auckland), Learning from Enforcement Cases to Manage GDPR Risks, 20 MIS Q. Executive (2024):
The European Union's General Data Protection Regulation (GDPR) is a ground-breaking data privacy and security law that affects organizations globally. Noncompliance can incur potentially hefty penalties, but compliance is not a box-ticking exercise and requires a risk-based approach. Based on an analysis of 93 cases of GDPR enforcement, we have identified 12 types of risk and their associated mitigation measures and risk indicators. We also describe the strategic actions that can be taken to manage GDPR risks.