On the Definition of Data Regulation Risk

The rapid development of Information and Communication Technologies (ICT) has led to firms embracing data processing. Scholars and professionals have developed a range of assessments and management methodologies to better answer the needs for trust and privacy in ICT. With the ambition of establishing trust by reinforcing the protection of individuals’ rights and privacy, economic interests and national security, policy makers attempt to regulate data processing through enactment of laws and regulations. Non-compliance with these norms may harm companies which in turn need to incorporate it in their risk assessment. We propose to define this new class of risk: “Data Regulation Risk” (DRR) as “a risk originating from the possibility of a penalty from a regulatory agency following evidence of non-compliance with regulated data processing and/or ICT governances and processes and/or information technologies and services”. Our definition clarifies the meaning of the defined terms in a given context and adds a specific scope to facilitate and optimize decision-making.