Challenges and Strategies of Business Organisations in Complying with Personal Data Protection and Privacy Laws: A Systematic Synthesis of Empirical Evidence

Design and Protocol Registration

This systematic review followed the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020 guidelines (Page et al., 2021). The SPIDER tool (Sample, Phenomenon of Interest, Design, Evaluation, Research Type) was used to frame the review question and guide inclusion criteria. SPIDER is particularly suited for synthesising evidence from qualitative and mixed-methods studies, which aligns with this study’s aim to explore complex organisational challenges beyond what purely quantitative metrics can capture (Cooke et al., 2012).

This review was not prospectively registered in a systematic review registry such as PROSPERO. The decision not to register was primarily due to the exploratory nature of the topic and the absence of a dedicated registry category for organisational and regulatory compliance reviews at the time the study commenced. Nonetheless, the full methodological protocol was documented internally and followed rigorously throughout the review process to ensure transparency and consistency. Retrospective registration is planned to enhance traceability, transparency, and comparability in future updates. Table 1 shows how the SPIDER elements guided the search strategy, selection criteria, and data extraction.

OPEN IN VIEWER

Table 1.

Operationalisation of Inclusion and Exclusion Criteria.

Element	Operational definition in this review
Sample	Business entities of any size or sector (for-profit or non-profit) operating in any jurisdiction
Phenomenon of Interest	Challenges or barriers, or obstacles to complying with statutory personal data-protection or privacy requirements
Design	Empirical studies employing quantitative, qualitative, or mixed designs; legal analyses; and industry reports providing primary data
Evaluation	Reported challenges (for example, financial, technical, organisational, and cultural) and their impacts on compliance
Research type	Quantitative, qualitative, and mixed-methods research published in peer-reviewed journals

Source. Authors’ work adapted from Cooke et al. (2012).

Eligibility Criteria

To ensure methodological rigour and relevance, this review included studies that met the following criteria: (i) examined challenges experienced by business organisations in complying with personal data protection or privacy legislation; (ii) were published in English between January 2015 and June 2025; and (iii) presented empirical findings derived from qualitative, quantitative, or mixed-methods research. Studies that did not meet the inclusion criteria were excluded from the analysis. A detailed summary of the inclusion and exclusion criteria, based on the SPIDER elements, is provided in Table 2.

OPEN IN VIEWER

Table 2.

Inclusion and Exclusion Criteria for Study Selection Based on SPIDER Framework.

Element	Inclusion criteria	Exclusion criteria
Sample	Studies focusing on business organisations, companies, enterprises, or firms (of any size or sector) globally	Studies focusing solely on individuals
Phenomenon	Papers reporting on compliance with personal data protection or privacy laws/regulations (for example, GDPR, national privacy laws)	Studies not related to data protection or not involving legal/regulatory compliance
Design	Qualitative, quantitative, or mixed-methods studies, including case studies, surveys, interviews, and content analysis	Editorials, opinion pieces, commentaries, book reviews, or grey literature
Evaluation	Studies that report challenges, barriers, limitations, or organisational experiences in implementing compliance	Papers focusing only on technical or legal definitions without organisational evaluation
Research type	Empirical peer-reviewed research (qualitative, quantitative, or mixed-methods)	Non-empirical work
Year	Studies published between 2015 and 2025	Studies published before 2015
Language	English language only	Non-English publications
Publication Type	Peer-reviewed journal articles and, where empirical methods and relevance were clearly demonstrated, high-quality preprints (e.g., arXiv) labelled as preprints and considered in sensitivity analysis	Conference papers, dissertations, theses, low-quality preprints, blogs, and reports

Source. Authors’ formulation.

Information Sources

A comprehensive literature search was conducted across four major academic databases: Scopus, IEEE Xplore, ACM Digital Library, and Google Scholar. These sources were selected to ensure broad coverage of multidisciplinary and technical literature relevant to data protection compliance. However, despite the omission of certain databases such as Web of Science, ProQuest, and ABI/INFORM, which are core sources for business and management research, specific measures were taken to minimise the risk of selection bias. These included using multidisciplinary databases (Scopus, IEEE Xplore, ACM Digital Library, and Google Scholar), as well as manually screening the reference lists of included studies to capture any potentially overlooked publications. Nevertheless, the omission of the above databases is recognised as a methodological limitation. In future iterations of this review, complementary databases such as Web of Science, ProQuest, and ABI/INFORM will be incorporated to strengthen coverage and ensure broader representation of business and organisational literature.

Search Strategy

The search strategy was developed using a combination of controlled vocabulary (such as database-specific subject headings) and free-text terms, guided by the SPIDER framework to ensure conceptual alignment with the review objectives. The strategy aimed to comprehensively identify empirical studies reporting on the challenges that business organisations face in complying with global personal data protection and privacy regulations.

Boolean operators (AND, OR), truncation symbols (example *), and phrase searching techniques were applied to enhance the precision and recall of search results across databases. A summary of the key search strings and results for each database is provided in Table 3.

OPEN IN VIEWER

Table 3.

Summary of Search Strings and Results Across Databases.

Database	Search string
Scopus	(“business” OR “organisation” OR “company” OR “enterprise” OR “firm”) AND (“challenge” OR “barrier” OR “obstacle” OR “limitation”) AND (“compliance” OR “adherence” OR “conformance”) AND (“data protection” OR “data privacy” OR “privacy law” OR “data regulation” OR “GDPR” OR “data governance”)
IEEE Xplore	(“business” OR “organisation” OR “company” OR “enterprise” OR “firm”) AND (“challenge” OR “barrier” OR “obstacle” OR “limitation”) AND (“compliance” OR “adherence” OR “conformance”) AND (“data protection” OR “data privacy” OR “privacy law” OR “data regulation” OR “GDPR” OR “data governance”)
Google Scholar	(“business” OR “organisation” OR “company” OR “enterprise” OR “firm”) AND (“challenge” OR “barrier” OR “obstacle” OR “limitation”) AND (“compliance” OR “adherence” OR “conformance”) AND (“data protection” OR “data privacy” OR “privacy law” OR “data regulation” OR “GDPR” OR “data governance”)
ACM Digital Library	[[All: “business”] OR [All: “organisation”] OR [All: “company”] OR [All: “enterprise”] OR [All: “firm”]] AND [[All: “challenge”] OR [All: “barrier”] OR [All: “obstacle”] OR [All: “limitation”]] AND [[All: “compliance”] OR [All: “adherence”] OR [All: “conformance”]] AND [[All: “data protection”] OR [All: “data privacy”] OR [All: “privacy law”] OR [All: “data regulation”] OR [All: “gdpr”] OR [All: “data governance”]] AND [E-Publication Date: (01/01/2015 TO 12/31/2025)]

Source. Authors’ work.

Selection Process

All records retrieved from the database searches were exported into Mendeley reference management software. Duplicate entries were first removed automatically and then manually verified to ensure data accuracy and integrity. The screening process proceeded in two main stages. First, titles and abstracts of all unique records were independently screened by two reviewers to assess their relevance based on the pre-defined eligibility criteria. Studies that clearly did not meet the inclusion criteria, such as those focusing on individuals instead of organisations or those unrelated to personal data protection, were excluded at this stage.

Second, the full texts of potentially eligible studies were retrieved and thoroughly reviewed. At this stage, any remaining uncertainties regarding a study’s inclusion were carefully evaluated against the SPIDER-based inclusion framework. All screening and selection steps were conducted independently by two reviewers.

During the screening process, any discrepancies between the two reviewers regarding study eligibility were first discussed to reach a mutual agreement. If consensus could not be achieved after discussion, the issue was referred to a third reviewer who acted as an independent arbiter. All decisions and justifications were recorded systematically, and the full selection process was documented using a PRISMA flow diagram.

Data Collection Process

A structured and piloted data extraction form was used to systematically collect relevant information from each included study. The form was designed to ensure a consistent and comprehensive approach to data capture, aligning closely with the review objectives and the SPIDER framework. The extracted information included the title of the study, the names of the authors, and the year of publication, along with the country or countries covered, the type of publication, and general study characteristics. Additional elements included the study's aim or purpose, study design or methodology, sector or industry focus, and organisational type. The reviewers also documented the sample description, data collection methods employed, and key findings reported.

Furthermore, particular attention was paid to identifying and summarising reported challenges, evaluating barriers to compliance, factors influencing compliance outcomes, and any strategies described by organisations to address these challenges. Data extraction was performed independently by two reviewers to enhance reliability. Any discrepancies or disagreements during the extraction process were resolved through discussion, and a third reviewer was consulted when necessary.

Risk of Bias Assessment

To ensure methodological quality and reduce the risk of bias in the synthesis process, all included studies were critically appraised using established tools appropriate to their design. Quantitative studies were assessed using the Joanna Briggs Institute (JBI) critical appraisal checklists, which evaluate key aspects such as study validity, reliability, and relevance (Barker et al., 2023). Qualitative studies were appraised using the Critical Appraisal Skills Programme (CASP) tool, which focuses on research rigour, credibility, and relevance (Humayoun et al., 2024). For mixed-methods studies, the Mixed Methods Appraisal Tool (MMAT) was employed, allowing for integrated assessment across qualitative and quantitative components (Hong et al., 2018). All appraisals were conducted independently by two reviewers. Any discrepancies in judgment were resolved through discussion, and if necessary, a third reviewer was consulted to reach a consensus.

Data Synthesis

Data synthesis was conducted on the final set of seventeen empirical studies that met all predefined eligibility, screening, and quality appraisal criteria, using a two-stage approach that integrated descriptive mapping and inductive thematic analysis within a narrative synthesis framework. This strategy was selected because of heterogeneity in study designs and the limited comparability of quantitative data across the included studies.

The first stage involved a comprehensive descriptive mapping of the included studies to contextualise the evidence base. Key characteristics of each study were systematically extracted, including year of publication, geographic focus, organisational type and sector, study design, and data collection methods. This mapping provided a foundational overview of the diversity, scope, and methodological profiles of the studies, enabling a better understanding of the contexts within which compliance challenges were reported.

In the second stage, an inductive thematic analysis was undertaken to identify and interpret the challenges faced by business organisations in complying with personal data protection and privacy legislation. This process began with line-by-line open coding of the extracted textual data. Codes were developed inductively and captured both explicit findings and underlying meanings related to compliance barriers.

The generated codes were then reviewed and clustered into higher-order conceptual categories based on their semantic similarity, frequency of occurrence, and analytical relevance. Through iterative analysis and constant comparison, these categories were refined into core themes representing the most recurrent and significant challenges encountered by organisations.

Two reviewers independently conducted the coding and categorisation processes, ensuring methodological transparency and reducing the risk of interpretive bias. Any discrepancies in theme identification were resolved through discussion, and, where necessary, consultation with a third reviewer was made.

While a limited number of studies reported quantitative results, these data varied in scope and design. As such, a formal meta-analysis was not conducted. Instead, the quantitative findings were synthesised descriptively to illustrate and reinforce key themes derived from the qualitative analysis, thereby offering additional insight into the prevalence and severity of certain challenges.

The results of the thematic analysis were presented in two complementary formats. First, a summary table was constructed, aligning each identified theme with representative codes and citing the relevant studies from which the findings were drawn. Second, a word cloud visualisation was developed to depict the frequency and prominence of key terms and concepts across the entire body of included literature. The relative size of each word in the cloud reflected its prevalence, providing an accessible overview of the dominant challenges in organisational personal data protection compliance.

Reporting Bias and Certainty Assessment

To assess the potential for reporting bias within the included studies, the Risk of Bias in Systematic Reviews (ROBIS) framework was applied. This tool facilitated a structured evaluation of bias across the review process, focusing on domains such as study identification, selection, data collection, and synthesis. Each domain was assessed for the presence of bias, and an overall judgment was made regarding the risk of bias in the body of evidence.

In parallel, the certainty of evidence for each major thematic finding emerging from the synthesis was evaluated using the GRADE-CERQual (Grading of Recommendations Assessment, Development, and Evaluation-Confidence in the Evidence from Reviews of Qualitative Research) approach. This framework considers four key components: methodological limitations, coherence of findings, adequacy of data, and relevance to the review question, to judge the overall confidence in each thematic category.

Study Selection

A total of 18,361 records were identified through comprehensive database searches, including Scopus (381), IEEE Xplore (32), ACM Digital Library (80), and Google Scholar (17,868). Following the automatic and manual removal of 5 duplicate records and the exclusion of 18,180 clearly ineligible entries, 176 unique records remained for screening.

Two reviewers independently screened titles and abstracts of these records. During this stage, 137 studies were excluded because they did not meet the predefined eligibility criteria, most commonly due to a lack of focus on organisational compliance challenges, irrelevance to data protection laws, or the absence of original empirical findings.

Subsequently, the full texts of 39 potentially eligible studies were retrieved and thoroughly examined. After applying the SPIDER-based inclusion criteria, 22 studies were excluded. The primary reasons for exclusion at this stage were failure to meet the empirical research requirement and a lack of focus on organisations.

Ultimately, 17 studies satisfied all inclusion criteria and were retained for the final synthesis. The detailed process of study selection is summarised in Figure 1 (PRISMA 2020 flow diagram).

OPEN IN VIEWER

Figure 1.

PRISMA 2020 flow diagram.

Study Characteristics

The included studies were published between 2017 and 2025 and covered diverse geographic regions, including Portugal, the United States of America, Switzerland, Spain, Austria, the United Kingdom, Sweden, Algeria, Malaysia, Italy, Germany, Croatia, Canada, and Brazil. Types of organisations identified were Small and Medium-Sized Enterprises (SMEs), Non-Governmental Organisations (NGOs), and public and private organisations. In addition, a range of sectors, including Information and Communication Technology (ICT), finance, healthcare, education, manufacturing, retail, and consumer technology, were also identified. Methodological designs comprised 8 qualitative, 4 quantitative, and 5 mixed-methods studies. The most common data collection methods used in the identified studies include interviews, surveys, and panel discussions. A summary of study characteristics is provided in Table 4.

OPEN IN VIEWER

Table 4.

Summary of Study Characteristics.

Study	Country	Methodology	Sector(s)	Organization type	Data collection
(Leite et al., 2022)	Portugal	Qualitative	Software engineering	SMEs	Interviews
(Lieftink et al., 2024)	Netherlands, Switzerland, UK, USA, Austria, Spain	Qualitative	Public health	Universities, gov, non-profits	Interviews, Panel discussion
(Li et al., 2022)	EU	Qualitative	Software (SME)	SMEs	Observation
(Cate, 2025)	EU, USA, Canada, Brazil	Qualitative	Technology, Healthcare, Finance	Large MNCs	Case studies
(Smirnova & Travieso-Morales, 2025)	Spain	Mixed-methods	Tech startups	Startups	Surveys, Interviews
(Poritskiy et al., 2019)	Portugal	Quantitative	IT	IT companies	Survey
(Brodin, 2019)	Sweden	Qualitative	General SMEs	SMEs	Workshops
(Benkaddour & Guettal, 2025)	Algeria	Mixed-methods	General business	Companies	Legal analysis, Modelling
(Julakanti et al., 2025)	USA	Mixed-methods	Finance Healthcare	Enterprises	Interviews,
(Schäfer et al., 2023)	Europe	Mixed-methods	Product-based	Private	Case studies, Interviews
(Chua et al., 2017)	Malaysia	Quantitative	12 sectors incl. Gov, Finance	Public and Private	Privacy Policy Review
(Oyetunji, 2024)	NIL	Quantitative	Multi-sector	Public and Private	Survey
(Klymenko et al., 2023)	NIL	Mixed-methods	Cross-industry	Public and Private	Interviews, Survey
(Granata et al., 2024)	Italy	Qualitative	Higher Education, ICT	University	Framework mapping, Case study
(Freitas & da Silva, 2018)	Portugal	Qualitative	Industrial SMEs	SMEs	Interviews
(Mladinić et al., 2023)	Croatia	Quantitative	Cross-sectoral	SMEs	Survey
(El-Gazzar & Stendal, 2020)	EU	Qualitative	Emerging Tech	Tech adopters	Legal analysis

Source. Extracted and summarised from included studies.

Notably, despite the global inclusion criteria, none of the identified studies originated from Sub-Saharan Africa or Latin America, highlighting significant research gaps and regional disparities in empirical evidence.

Risk of Bias in Studies

The risk of bias was assessed using the appropriate tools: JBI for quantitative studies, CASP for qualitative studies, and MMAT for mixed-methods studies. In general, 7 studies were rated as moderate and 10 as low based on criteria such as methodological rigour, clarity of reporting, and relevance to the review objectives.

Results of Individual Studies

The 17 studies included in this review revealed a diverse but overlapping set of challenges that business organisations face when complying with personal data protection and privacy laws. Rather than being isolated, these challenges often intersect across technical, organisational, legal, and contextual dimensions. To provide analytical clarity, the findings were grouped into several thematic domains: organisational and governance constraints, technical implementation and tooling gaps, privacy risk management and strategic alignment, human capacity and training limitations, and sectoral and context-specific variability.

A recurring theme across multiple studies was the lack of organisational preparedness and governance structures necessary to support compliance efforts. In particular, many SMEs struggled with unclear internal policies, poor documentation practices, and limited leadership engagement in personal data protection initiatives. This was evident in studies such as those by Leite et al. (2022), Brodin (2019), and Freitas and da Silva (2018), which highlighted challenges related to embedding GDPR principles in development processes, the absence of a compliance culture, and the lack of institutional support.

From a technical perspective, implementation and tooling challenges were widespread as well. Several studies, including those by Li et al. (2022), Granata et al. (2024), and El-Gazzar and Stendal (2020) noted difficulties in operationalising privacy requirements, automating compliance testing, and aligning legal mandates with the design of emerging technologies like AI, blockchain, and federated learning (FL). The technical complexity was often compounded by insufficient interoperability, weak infrastructure, and reliance on manual systems.

Another domain of concern was privacy risk management and strategic alignment. Studies by Lieftink et al. (2024), Cate (2025), and Klymenko et al. (2023) underscored the tension between innovation and compliance, particularly in high-stakes environments such as healthcare and AI. These studies revealed how uncertainty in legal interpretations, distributed responsibilities in federated systems, and the absence of standardised frameworks made it difficult for organisations to assess and manage personal data protection risks effectively.

The human capacity and training limitations domain was a prominent barrier in multiple studies, especially among SMEs and organisations in low-resource settings. Lack of staff awareness, inadequate training, and absence of dedicated roles like DPOs were frequently mentioned (Mladinić et al., 2023; Oyetunji, 2024; Smirnova & Travieso-Morales, 2025). These deficits often result in weak enforcement of compliance policies and inadequate documentation practices.

Finally, sectoral and context-specific variability shaped how challenges manifested and were addressed. For example, public institutions in Malaysia Chua et al. (2017) showed lower compliance levels compared to private entities due to poor standardisation and weak enforcement. Similarly, organisations in developing countries like Algeria (Benkaddour & Guettal, 2025) SMEs in Portugal and Croatia faced resource shortages and limited legal clarity, which significantly hampered their ability to implement compliance measures effectively. Table 5 summarises these studies.

OPEN IN VIEWER

Table 5.

Thematic Domains.

Domain	Authors
Organisational and governance constraints	(Brodin, 2019; Cate, 2025; Chua et al., 2017; Julakanti et al., 2025; Leite et al., 2022; Schäfer et al., 2023)
Technical implementation and tooling gaps	(Benkaddour & Guettal, 2025; El-Gazzar & Stendal, 2020; Granata et al., 2024; Leite et al., 2022; Li et al., 2022)
Privacy risk management and strategic alignment	(Cate, 2025; Klymenko et al., 2023; Li et al., 2022; Lieftink et al., 2024)
Human capacity and training limitations	(Freitas & da Silva, 2018; Mladinić et al., 2023; Oyetunji, 2024; Smirnova & Travieso-Morales, 2025)
Sectoral and context-specific variability	(Hui Na Chua et al., 2017; Nazar Poritskiy et al. 2019; Rania El-Gazzar & Stendal, 2020; Yelena Smirnova et al., 2025)

Source. Authors’ thematic synthesis.

Results of Syntheses

Thematic Synthesis

Thematic synthesis was conducted on the seventeen studies that satisfied all eligibility and quality assessment criteria, following a structured screening and selection process. Codes and themes were derived iteratively to ensure that only evidence directly related to organisational compliance with personal data protection and privacy laws was included in the final analytical framework. The detailed coding structure, including representative codes, corresponding themes, and source studies, is presented in Appendix A.

Challenges Reported by Business Organisations

The evidence from the included studies shows that challenges encountered by business organisations in complying with personal data protection and privacy laws are diverse but conceptually related across several thematic domains. While individual studies report specific barriers, the synthesis reveals recurring patterns linked to organisational capacity and culture, techno-regulatory and implementation complexity, and governance and data-handling practices. As presented in Table 6, these clustered themes provide a structured overview of the key issues identified in the literature, highlighting how knowledge gaps, resource constraints, regulatory ambiguity, technological integration challenges, and data governance limitations collectively influence organisational compliance efforts.

(1) Organisational capacity and culture constraints

OPEN IN VIEWER

Table 6.

Clustered Synthesis of Challenges Faced by Business Organisations in Complying with Personal Data Protection and Privacy Laws (n = 17).

Clustered challenges	Key issues identified	Supporting studies
Organisational capacity and culture constraints	Capacity gaps in knowledge and awareness, Financial and resources constraints, Organisational preparedness and culture	(Freitas & da Silva, 2018; Granata et al., 2024; Leite et al., 2022; Li et al., 2022; Oyetunji, 2024; Poritskiy et al., 2019)
Techno-regulatory and implementation complexity	Integration challenges in software development, Technical and regulatory complexity, and a lack of clear guidelines and standards	(El-Gazzar & Stendal, 2020; Granata et al., 2024; Klymenko et al., 2023; Leite et al., 2022; Li et al., 2022; Lieftink et al., 2024; Schäfer et al., 2023; Smirnova & Travieso-Morales, 2025)
Governance, accountability, and data-handling challenges	Consent management challenges, Data management and quality issues, Enforcement and compliance monitoring gaps, Third-party and international data issues	(Benkaddour & Guettal, 2025; Brodin, 2019; Chua et al., 2017; El-Gazzar and Stendal, 2020; Julakanti et al., 2025; Lieftink et al., 2024; Mladinić et al., 2023; Poritskiy et al., 2019; Schäfer et al., 2023)

Source. Authors’ work.

The reviewed studies consistently indicate that organisational capacity limitations constitute a fundamental barrier to effective compliance with personal data protection laws. Business organisations often demonstrate significant gaps in knowledge and awareness, with low levels of privacy literacy and insufficient training hindering their ability to interpret and implement regulatory requirements (Leite et al., 2022; Li et al., 2022; Oyetunji, 2024). These gaps are closely linked to the absence of a strong compliance culture and limited institutional readiness, particularly among SMEs and resource-constrained firms. Financial and operational constraints further exacerbate these challenges, as organisations struggle to allocate adequate budgets for compliance tools, specialist personnel, audits, and continuous training (Brodin, 2019; Freitas & da Silva, 2018; Granata et al., 2024; Li et al., 2022; Mladinić et al., 2023). In addition, limited organisational preparedness and weak internal capacity, including insufficient staff training and inadequate resource allocation, reduce organisations’ ability to integrate personal data protection practices into routine operations (Poritskiy et al., 2019; Smirnova & Travieso-Morales, 2025). Collectively, these findings suggest that compliance challenges are strongly rooted in internal organisational culture, skills, and resource readiness rather than purely technical shortcomings.

(2) Techno-regulatory and implementation complexity

Another major cluster of challenges concerns the complexity of integrating personal data protection requirements into evolving technological and regulatory environments. Several studies highlight persistent difficulties in embedding compliance into software development processes, particularly when privacy considerations are not incorporated early in the system lifecycle or when organisations rely on rigid development models such as the waterfall approach (Leite et al., 2022; Li et al., 2022). At the same time, organisations face increasing technical and regulatory complexity due to high data volumes, opaque AI systems, and the need to navigate overlapping legal frameworks across jurisdictions (Cate, 2025; El-Gazzar & Stendal, 2020; Klymenko et al., 2023; Schäfer et al., 2023; Smirnova &Travieso-Morales, 2025). The lack of clear guidelines and standardised frameworks further complicates aligning technical solutions with legal requirements, leading to uncertainty and inconsistent implementation practices (Granata et al., 2024; Klymenko et al., 2023; Lieftink et al., 2024). Moreover, the adoption of emerging technologies such as AI and federated learning introduces additional concerns related to trust, transparency, and accountability, as system opacity makes it difficult for organisations to explain automated decision-making processes and ensure lawful data handling (Lieftink et al., 2024). These interconnected technological and regulatory pressures collectively increase implementation difficulty and elevate the risk of non-compliance.

(3) Governance, accountability, and data-handling challenges

The synthesis also reveals that governance structures, accountability mechanisms, and data management practices represent critical areas of concern for organisational compliance. Consent management remains particularly complex where legal provisions are ambiguous and operational systems are not designed to handle dynamic consent requirements, resulting in difficulties in obtaining, recording, and updating valid consent across layered processing environments (Brodin, 2019; Mladinić et al., 2023; Schäfer et al., 2023). In addition, organisations frequently encounter challenges in maintaining reliable data management practices, including unclear data ownership, fragmented storage infrastructures, poor classification systems, and limited capacity to ensure data accuracy, erasure, and traceability (Julakanti et al., 2025; Lieftink et al., 2024; Poritskiy et al., 2019). Weak enforcement and compliance-monitoring mechanisms in some regulatory contexts further reduce the perceived urgency to adhere, as organisations face uncertainty about regulatory expectations and the consequences of non-compliance (Benkaddour & Guettal, 2025; Chua et al., 2017). These governance issues are compounded by the complexities of the third-party and international data processing, where subcontractors, cross-border data flows, and decentralised technological architectures create additional accountability and oversight challenges (El-Gazzar & Stendal, 2020; Poritskiy et al., 2019). Generally, limitations in governance clarity, accountability structures, and data-handling systems significantly constrain the consistent and effective implementation of personal data protection compliance within business organisations.

Strategies Business Organisations Use to Address the Challenges

The strategies identified across the included studies reflect a set of complementary organisational, technical, and governance-oriented responses adopted to address the multifaceted challenges of personal data protection compliance. As summarised in Table 7, these strategies are not implemented in isolation but tend to align with the nature of the barriers organisations face, particularly regarding capacity limitations, technological risks, and governance requirements. The synthesis indicates that business organisations commonly rely on preventive technical safeguards, risk governance and organisational strengthening measures, and standardisation and documentation practices to enhance their compliance capabilities and ensure more consistent adherence to personal data protection and privacy regulations.

(1) Preventive design and technical safeguards

OPEN IN VIEWER

Table 7.

Clustered Synthesis of Strategies Adopted by Business Organisations to Address Compliance Challenges.

Clustered strategies	Key mechanisms	Supporting studies
Preventive design and technical safeguards	Privacy by design and privacy principles	(Cate, 2025; Leite et al., 2022; Schäfer et al., 2023)
	Encryption and access control	(Benkaddour & Guettal, 2025; Cate, 2025)
Risk governance and organisational strengthening	Risk and incident management	(Cate, 2025; Julakanti et al., 2025)
	Data protection officers and governance	(Julakanti et al., 2025; Poritskiy et al., 2019; Schäfer et al., 2023; Smirnova & Travieso-Morales, 2025)
	Training and awareness	(Brodin, 2019; Chua et al., 2017; Oyetunji, 2024; Poritskiy et al., 2019; Smirnova & Travieso-Morales, 2025)
Standardisation and documentation practices	Standardised policies and templates	(Brodin, 2019; Cate, 2025; Chua et al., 2017; Julakanti et al., 2025)

Source. Authors’ work.

The reviewed studies show that many business organisations adopt preventive and technically oriented measures to strengthen compliance with personal data protection and privacy laws. A key approach is the application of privacy-by-design and privacy principles, in which data protection requirements are embedded into system architecture and development lifecycles from the early stages (Cate, 2025; Leite et al., 2022; Schäfer et al., 2023). By integrating privacy considerations such as data minimisation, purpose limitation, and consent mechanisms into technical workflows, organisations are better able to align operational processes with regulatory expectations. In addition, encryption and access control mechanisms are widely implemented to secure personal data during storage and processing, including role-based access controls, authentication systems, and encryption protocols, to prevent unauthorised access and enhance data confidentiality (Benkaddour & Guettal, 2025; Cate, 2025). These technical safeguards function as proactive compliance tools that reduce exposure to breaches while supporting accountability and audit readiness within organisational data protection practices.

(2) Risk governance and organisational strengthening

Another major cluster of strategies focuses on strengthening organisational resilience through structured risk management and internal capacity development. Risk and incident management practices, including formal risk assessments, vulnerability evaluations, and incident response protocols, are increasingly adopted to identify compliance risks and ensure timely mitigation in the event of breaches or policy failures (Cate, 2025; Julakanti et al., 2025). Alongside this, organisations invest in training and awareness initiatives aimed at improving staff understanding of legal obligations and responsible data-handling practices (Brodin, 2019; Chua et al., 2017; Oyetunji, 2024; Poritskiy et al., 2019; Smirnova & Travieso-Morales, 2025). Such initiatives include targeted training for developers, employee awareness programmes, and public education efforts to enhance transparency and trust. Furthermore, the establishment of Data Protection Officers (DPOs) and formal governance structures has been identified as a critical organisational response, as these roles provide oversight, consistent interpretation of regulatory requirements, and coordination of compliance activities across departments (Julakanti et al., 2025; Poritskiy et al., 2019; Schäfer et al., 2023; Smirnova & Travieso-Morales, 2025). Collectively, these measures strengthen internal governance and enhance organisational readiness to manage complex data protection obligations.

(3) Standardisation and documentation practices

The synthesis also indicates that organisations increasingly rely on standardisation and structured documentation to improve clarity and consistency in compliance implementation. The development and use of standardised policies, privacy notices, and regulatory templates, such as Data Protection Impact Assessments (DPIAs), help streamline compliance processes and ensure alignment with legal and industry standards (Brodin, 2019; Cate, 2025; Chua et al., 2017; Julakanti et al., 2025). These structured policy frameworks provide organisations with clear reference points for interpreting regulatory requirements and reducing ambiguity in operational decision-making. By institutionalising standardised documentation and policy development processes, organisations enhance transparency, facilitate monitoring and auditing, and promote more consistent application of personal data protection principles across organisational units and regulatory contexts.

Quantitative Summary

Among the 17 studies included in the review, four employed primarily quantitative approaches, and five employed mixed-methods approaches with a quantitative component, enabling numerical assessment of compliance practices, challenges, and organisational behaviours.

For example, Poritskiy et al. (2019) conducted a survey of 286 ICT organisations in Portugal, revealing that audits, technical complexity, and managing subcontractors were among the most significant barriers to GDPR implementation. Similarly, Mladinić et al. (2023) reported that only 37.68% of SMEs in Croatia felt adequately informed about GDPR, with limited use of key compliance tools such as DPIA and breach reporting mechanisms.

Oyetunji (2024) carried out a cross-sectoral survey that identified a strong positive correlation between awareness and compliance performance, highlighting the impact of training and budgeting. In another study, Chua et al. (2017) assessed 168 privacy policies across sectors in Malaysia and found that compliance levels were generally low, especially in government-owned organisations, due to poor standardisation and a lack of enforcement mechanisms.

Across these quantitative findings, consistent trends emerged: resource limitations, low awareness, and organisational readiness were key predictors of non-compliance. Moreover, sectoral differences (for example, public vs. private, tech vs. healthcare) were evident in how organisations approached and prioritised privacy compliance. To facilitate comparison among the quantitative and mixed-methods studies, a brief cross-study summary is presented in Table 8.

OPEN IN VIEWER

Table 8.

Comparative Summary of Quantitative or Mixed-methods Results.

Study	Country/Region	Sector	n	Indicators	Main numeric result
Poritskiy et al., 2019	Portugal	ICT	286	Barriers survey	Audits, technical complexity, and subcontractor management most cited
Mladinić et al., 2023	Croatia	SMEs	227	Awareness/tools use	37.7 % felt adequately informed; low DPIA/breach practice
Chua et al., 2017	Malaysia	Public/private	168	Policy compliance	Public bodies scored lower than private ones
Oyetunji, 2024	Multi-sector	Various	210	Awareness–compliance link	Training and budgeting are positively correlated with compliance

Source. Authors’ work.

Because the quantitative studies included in the review differed widely in design, outcome measures, and analytical focus, statistical aggregation through meta-analysis was neither appropriate nor methodologically valid. The narrative synthesis approach was therefore adopted to ensure interpretive consistency across diverse study types.

Interpretation of Findings

This review synthesises empirical evidence on the challenges faced by business organisations in complying with personal data protection and privacy laws, as well as the strategies adopted to overcome them. Viewed through the lenses of socio-technical systems (STS) theory, the Technology–Organisation–Environment (TOE) framework, and institutional theory, the findings reveal that data protection compliance is a dynamic, multi-layered process shaped by interactions between technological infrastructures, organisational capacities, and regulatory environments.

While earlier reviews have identified comparable operational and regulatory barriers, the present synthesis advances the field by moving beyond descriptive accounts. It systematically connects these challenges to socio-technical misalignments and institutional pressures, offering an explanatory perspective on why compliance difficulties persist across organisational contexts rather than merely describing them.

A central pattern emerging from the evidence is the persistent organisational capacity gap in knowledge, skills, and institutional readiness. From an STS perspective, these deficits illustrate a misalignment between the social and technical subsystems that underpin compliance performance. In many organisations, especially small and medium-sized enterprises (SMEs), the technical systems for data handling are advanced, yet the human and procedural elements remain weak. The lack of a privacy-aware culture, limited training, and absence of compliance leadership hinder the effective integration of regulatory requirements into everyday operations (Leite et al., 2022; Li et al., 2022; Oyetunji, 2024). This imbalance demonstrates that technology alone cannot guarantee compliance without concurrent social and organisational adaptation.

The integration of privacy-by-design principles into system development proved particularly difficult, aligning with the organisational component of the TOE framework. Embedding privacy into software lifecycles requires structural and managerial adjustments, such as cross-functional collaboration, developer training, and consistent managerial support, which many firms lack. For SMEs operating under resource constraints, compliance becomes reactive rather than strategic, as studies show a reliance on minimal policy documentation rather than on systematic process integration (Li et al., 2022).

Technical and regulatory complexity further exemplifies the “environment” dimension of the TOE framework. Organisations operate within overlapping legal regimes and rapidly evolving technological contexts, creating uncertainty and implementation fatigue (Cate, 2025; Smirnova & Travieso-Morales, 2025). Particularly in sectors where innovation and compliance intersect, such as health technology and financial services, firms struggle to balance rapid product development with the need for demonstrable accountability. These findings affirm institutional theory’s assertion that external coercive pressures shape organisational behaviour, in this case from regulators and market expectations, as well as by mimetic tendencies to emulate perceived best practices.

Equally, the absence of clear regulatory guidelines and standards constrains institutional conformity. Where legal frameworks are ambiguous or unevenly enforced, organisations interpret compliance obligations inconsistently, resulting in fragmented and sometimes symbolic compliance (Granata et al., 2024; Klymenko et al., 2023). Institutional theory helps explain this variation: in weakly institutionalised environments, organisations often adopt minimal or imitative compliance postures, treating data protection as an administrative requirement rather than a strategic objective.

Challenges of trust, transparency, and accountability in AI and federated learning (FL) systems highlight the deep interplay between technical opacity and regulatory expectations. From a socio-technical standpoint, these “black-box” technologies blur the boundary between human oversight and machine autonomy, complicating accountability structures and compliance verification (Lieftink et al., 2024). These findings illustrate the need for adaptive governance models where human judgment, algorithmic auditability, and regulatory compliance co-evolve.

Financial and resource constraints, particularly among SMEs, remain the most tangible organisational barrier. TOE’s organisational dimension explains this through differences in resource endowment and managerial capability. Firms with limited budgets often struggle to appoint data protection officers (DPOs), invest in encryption technologies, or conduct regular audits (Freitas & da Silva, 2018; Mladinić et al., 2023). The disparity in resource distribution suggests that compliance maturity is unevenly scalable across organisational sizes and regions.

Despite these challenges, several promising strategies were identified. Organisations that institutionalised training programmes, appointed DPOs, and implemented privacy-by-design principles demonstrated stronger alignment between social and technical subsystems – an indicator of higher STS maturity. The use of standardised templates and policy frameworks, meanwhile, reflects the institutional diffusion of best practices and the emergence of isomorphic pressures driving convergence toward recognised norms (Brodin, 2019; Poritskiy et al., 2019).

However, the scalability and transferability of these successful practices remain contingent upon contextual factors. In developed economies, compliance interventions benefit from well-resourced institutions, established legal ecosystems, and robust enforcement mechanisms. Conversely, in developing or transitional contexts, weak regulatory capacity, limited funding, and low technical expertise hinder replication of such models. From a TOE perspective, the environmental conditions, regulatory maturity, infrastructural readiness, and market incentives determine whether these strategies can be feasibly adapted. This implies that policy learning should focus not on direct transplantation of EU-style frameworks, but on modular adaptation that reflects local institutional realities.

The synthesis reinforces that compliance with personal data protection laws is neither purely legal nor purely technical. It is an evolving socio-technical and institutional process in which effectiveness depends on the interplay among organisational capacity, leadership commitment, regulatory coherence, and the external environment. Integrating these theoretical perspectives clarifies why compliance success varies across contexts and provides a conceptual foundation for designing scalable, context-responsive interventions.

Although the review adopted a global search strategy, the geographical distribution of available studies reflects a concentration in developed regions, particularly Europe and North America. The findings should therefore be interpreted as a synthesis of existing empirical evidence rather than a comprehensive global analysis. This limitation highlights the continuing scarcity of empirical research from Sub-Saharan Africa, Latin America, and large parts of Asia, and reinforces the need for future studies that capture the organisational experiences of under-represented regions.

Study Implications

The findings of this systematic review have important theoretical, practical, and policy implications for understanding and improving organisational compliance with personal data protection and privacy laws. Together, they demonstrate that compliance is not a static legal obligation but an adaptive socio-technical process that evolves within organisational and institutional constraints.

Study Limitations and Future Direction

The following subsections outline key methodological and contextual constraints of the review, as well as opportunities for advancing future research in this evolving field.

Contributions of the Study

This study makes several significant contributions to scholarship and practice in the field of data protection and organisational compliance.

First, it provides one of the few empirical syntheses of organisational-level evidence on personal data protection and privacy compliance. By systematically analysing findings from seventeen peer-reviewed studies, the review consolidates dispersed insights from legal, technical, and managerial perspectives, offering an integrated understanding of how businesses experience and respond to compliance demands.

Second, the study contributes theoretically by advancing a multi-framework perspective that integrates socio-technical systems theory, the Technology–Organisation–Environment (TOE) model, and institutional theory. This synthesis moves beyond descriptive listings of barriers to explain why and how compliance challenges emerge at the intersection of technology, organisational capacity, and regulatory context. The framework provides a conceptual foundation for future empirical testing and model refinement.

Third, the review contributes methodologically by demonstrating the applicability of the PRISMA and SPIDER frameworks to organisational and regulatory compliance research, a domain that is often dominated by conceptual or legal analyses rather than systematic evidence synthesis.

Fourth, the findings have practical and policy relevance. They identify concrete organisational strategies such as appointing data protection officers (DPOs), embedding privacy-by-design principles, and adopting standardised compliance templates. They also generate actionable policy recommendations, including context-specific regulatory toolkits, sector-based capacity-building programmes, and the use of regulatory sandboxes to encourage innovation while maintaining accountability.

Finally, by highlighting regional and linguistic imbalances in the existing evidence, the study establishes an agenda for future research that prioritises inclusivity, cross-regional collaboration, and the adaptation of compliance models to resource-constrained environments. In doing so, it provides a foundation for both scholarly inquiry and evidence-informed policymaking in emerging data protection regimes.

Protocol Registration

This review was not prospectively registered in a systematic review registry such as PROSPERO. The authors acknowledge the value of registration in enhancing transparency and reducing duplication and recommend it for future related syntheses. A formal review protocol was not publicly posted or published prior to conducting the review. However, the methods were carefully pre-defined in line with the SPIDER framework and were rigorously followed throughout the review process to maintain consistency and methodological integrity. No protocol amendments occurred during the review. The eligibility criteria, data extraction procedures, synthesis strategy, and risk of bias assessments were adhered to as initially planned.