An empirical study on the impact of GDPR and right to be forgotten - organisations and users perspective

Abstract

The General Data Protection Regulation (GDPR) is a prescriptive legislation in the European Union (EU) for privacy and data protection that applies to every organisation within the EU and any organisation outside the EU if they offer goods or services to EU citizens. The enforcement of GDPR created a big challenge for organisations which were required to create new professional figures, system, policies, procedures and standards, budget for new investments, and to set up a project plan or catalogue specific to the GDPR. This paper focuses on the GDPR 'right to be forgotten' and the specific implementation challenges it poses. The research study used two surveys to collect data from both organisations and users. The results show that while organisations are struggling with GDPR and right to be forgotten, there are also positive aspects about its implementation that translate into improved data privacy. The findings related to the users show that they are in general happy with the legislation.