Towards a GDPR Compliance Assessment Toolkit

Authors

  • Sipho Ngobeni Council for Scientific and Industrial Research, Pretoria, South Africa https://orcid.org/0009-0003-1839-1177
  • Ntombizodwa Thwala Council for Scientific and Industrial Research, Pretoria, South Africa
  • Nokuthaba Siphambili Council for Scientific and Industrial Research, Pretoria, South Africa https://orcid.org/0009-0006-6091-9838
  • Phumeza Pantsi Council for Scientific and Industrial Research, Pretoria, South Africa
  • Bokang Molema Council for Scientific and Industrial Research, Pretoria, South Africa
  • Jacob Lediga Council for Scientific and Industrial Research, Pretoria, South Africa
  • Pertunia Senamela Council for Scientific and Industrial Research, Pretoria, South Africa https://orcid.org/0009-0003-8718-258X

DOI:

https://doi.org/10.34190/eccws.23.1.2278

Keywords:

GDPR, Privacy, Data Controller, Data Processor, Personal Data, Compliance Assessment

Abstract

The European Union's (EU) General Data Protection Regulation (GDPR) makes it illegal to collect, process, and store personal data unless it is done in accordance with the prescribed legal and regulatory clauses enshrined in the Act. Organisations face significant challenges in navigating GDPR requirements and assessing their level of compliance. In particular, failure to comply with GDPR may potentially expose the data Controller and Processor to steep legal penalties including possibly administrative fines of up to 20 000 000 EUR, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, which is imposed by the Supervisory Authority. This paper presents the results of a minimum viable product, the GDPR Compliance Assessment Toolkit (GCAT). The main objective of the GCAT is to assist organisations to assess their current state of compliance to GDPR. Drawing from an experimental research and development approach, GCAT is then compared with other existing GDPR compliance assessment technologies. Comparative analysis results shows that GCAT simplifies and optimize GDPR compliance assessments.

Author Biographies

Sipho Ngobeni, Council for Scientific and Industrial Research, Pretoria, South Africa

Sipho Ngobeni is a Senior Cybersecurity Researcher at the Council for Scientific and Industrial Research (CSIR) with more than a decade of experience assisting industry in implementing Cybersecurity Governance, Risk and Compliance Solutions. His research focuses on data privacy, third party risk management, cyber incident response, and CSIRT operations.

Ntombizodwa Thwala, Council for Scientific and Industrial Research, Pretoria, South Africa

Ntombizodwa Thwala is a cybersecurity specialist at the Council for Scientific and Industrial Research (CSIR). Her research focuses on cybersecurity governance, risk and compliance, digital forensics, machine learning (ML), artificial intelligence (AI), open-source intelligence (OSINT), cybersecurity awareness training, penetration testing, and vulnerability assessments.

Nokuthaba Siphambili, Council for Scientific and Industrial Research, Pretoria, South Africa

Nokuthaba Siphambili is a cybersecurity researcher at the Council for Scientific and Industrial Research (CSIR) within the Information and Cyber Security Centre (ICSC) and a Master’s student at the University of Pretoria. Her current research interests lie at the intersection of cybersecurity, governance, privacy, and trust.

Phumeza Pantsi, Council for Scientific and Industrial Research, Pretoria, South Africa

Phumeza Pantsi is a Software Developer and Researcher at the Council for Scientific and Industrial Research (CSIR) within the Information and Cyber Security Centre (ICSC). She is a strategist and fascinated about research, design and development of cybersecurity systems to help solve client’s problems.

Bokang Molema, Council for Scientific and Industrial Research, Pretoria, South Africa

Bokang Molema is a Software Engineer and Researcher at the Council for Scientific and Industrial Research (CSIR) within the Information and Cyber Security Centre (ICSC). She specialises in the research and development of cyber security systems.

Jacob Lediga, Council for Scientific and Industrial Research, Pretoria, South Africa

Jacob Lediga is a Software Developer at the Council for Scientific and Industrial Research (CSIR), where he contributes to development of innovative solutions using his software engineering skills. Jacob is passionate about technology, where he specialises in software development, software testing, and problem-solving.

Pertunia Senamela, Council for Scientific and Industrial Research, Pretoria, South Africa

Pertunia Senamela is a Software Developer at the Council for Scientific and Industrial Research (CSIR), within the Information and Cyber Security Centre (ICSC). Her role involves coding, research, and knowledge dissemination. Her research is dedicated to exploring the convergence of cybersecurity principles with software development practices.

Downloads

Published

2024-06-21