Proposed Model for Data Governance Implementation with an Emphasis on Privacy

Document Type : Original Article

Authors

1 azad kish uniDepartment of Information Technology Management, Kish International Branch, Islamic Azad University, Kish , Iran

2 Department of Information Technology Management, School of Management and Economics, Science and Research Branch, Islamic Azad University, Tehran, Iran

3 Department of Industrial Management, Faculty of Management, Islamic Azad University, Karaj Branch, Karaj, Iran

4 Department of Information Technology, Central Tehran Branch, Islamic Azad University, Tehran, Iran

Abstract

Objective: In the contemporary digital landscape, data governance stands as a critical challenge in both IT policy and technology law. Given the increasing volume of personal data processing and exchange, the necessity for a localized data governance framework, tailored to a country’s specific legal and technological infrastructure, is more pressing than ever. This study proposes a data governance model with a strong emphasis on privacy, addressing current challenges and providing practical solutions for improving personal data management. The primary objective is to develop a localized data governance framework for Iran, aligned with international standards such as the GDPR and the CCPA. By analyzing legal gaps, implementation challenges, and potential solutions, this study aims to establish a practical framework that not only enhances security and privacy protection but also fosters public trust in digital services.
Methodology: This applied-developmental study utilizes a mixed-methods approach. In the qualitative phase, legal documents, regulatory policies, and existing data governance models from Iran and other countries were analyzed. Furthermore, the Delphi method was employed to collect and examine the insights of 58 experts in technology, digital law, and information security. In the quantitative phase, Confirmatory Factor Analysis (CFA) was applied to validate the proposed model. Data were gathered through semi-structured expert interviews, a review of domestic laws and policies, and comparative studies with international frameworks. Key model indicators were extracted using qualitative content analysis, and statistical tests were employed to assess the model’s validity and reliability.
Findings: Results indicate that the primary challenges to data governance in Iran include the lack of an integrated legal framework, the absence of an independent regulatory body, and deficiencies in the enforcement of data protection policies. A comparative analysis with the European GDPR and the U.S. CCPA revealed that Iran lacks clear requirements for data processing transparency and independent oversight—two pillars of international standards. Furthermore, findings indicate high levels of privacy concern among Iranian users; 78% expressed anxiety regarding how their data is managed on domestic platforms. The proposed model comprises three dimensions (legal-policy, technical-technological, and organizational-regulatory), six components, and 24 operational indicators. Data analysis demonstrated that implementing this model could reduce privacy violations by 30.8%, increase user trust in digital services by 44.6%, and improve regulatory efficiency by 38.2%.
Conclusion: Data governance in Iran requires a transparent and binding framework that enhances security and user data protection while improving database interoperability and the efficiency of regulatory institutions. This study underscores that drafting comprehensive data governance legislation and establishing an independent regulatory body are critical steps. Additionally, implementing robust security policies, advanced encryption, and revising laws related to data collection and processing can mitigate cybercrimes and bolster public trust. A comparative analysis shows that the proposed model possesses a high degree of adaptability to global standards, suggesting that its proper implementation could enhance data protection standards by up to 79.4%. Ultimately, this research highlights the urgent need to reform data governance policies, enact new regulations, and increase transparency in personal data management. Future studies should focus on evaluating the practical implementation of this model within both public and private sectors.

Keywords

Main Subjects

References

Acquisti, A., Brandimarte, L., & Loewenstein, G. (2020). Secrets and likes: The drive for privacy and the difficulty of achieving it in the digital age. Journal of Consumer Psychology, 30(4), 736–758.
Alhazmi, H., Imran, A., & Abu Alsheikh, M. (2024). Perception of digital privacy protection: An empirical study using GDPR framework. arXiv preprint arXiv:2411.12223.
Bannister, F., & Connolly, R. (2022). Information governance and the public sector: Challenges and opportunities. Government Information Quarterly, 39(1), 101–112.
Black, J., Lodge, M., & Thatcher, M. (2023). Regulatory governance in the digital age: Data governance frameworks. Journal of Public Policy, 42(1), 78–95.
Chamani, A., et al. (2024). Presenting a data governance model for social networks in Iran. Technology Policy Quarterly, 17(2), 87–105. [In Persian]
Chen, H., & Zhang, H. (2021). Data governance for digital transformation: A conceptual framework. Journal of the Association for Information Systems, 22(4), 875–900.
Citron, D. K. (2022). The fight for privacy: Protecting dignity, identity, and love in the digital age. W.W. Norton & Company.
Cohen, J. E. (2021). Privacy, visibility, transparency, and exposure. University of Chicago Law Review, 86(2), 1087–1154.
Daniali, R., & Sedighi, S. (2023). Analyzing the state of data governance in Iranian organizations. Public Management Studies, 19(1), 45–63. [In Persian]
Davidson, E., Vaast, E., & Wagner, E. (2023). Data governance in practice: Bridging compliance and innovation. Information Systems Journal, 33(2), 210–228.
Floridi, L. (2021). The ethics of information. Oxford University Press.
Greenleaf, G. (2020). Global Data Privacy Laws 2020: A comprehensive overview. Privacy Laws & Business International Report.
Kuner, C. (2020). Transborder Data Flows and Data Privacy Law. Oxford University Press.
Ladley, J. (2020). Data Governance: How to Design, Deploy and Sustain an Effective Data Governance Program. Elsevier.
Mousavi, A., et al. (2023). Challenges of implementing privacy protection policies in Iran. Technology Law Studies, 9(2), 115–132. [In Persian]
Ng, I., & Wakenshaw, S. Y. L. (2022). The digital transformation of industries: A review and research agenda. Information Systems Frontiers, 24(1), 25–42.
Nissenbaum, H. (2019). Privacy in context: Technology, policy, and the integrity of social life. Stanford University Press.
Otto, B. (2019). How to design a data governance framework. Business Process Management Journal, 25(4), 967–983.
Padarha, S. (2023). Data-driven dystopia: An uninterrupted breach of ethics. arXiv preprint arXiv:2305.07934.
Payandeh, M. (2024). Designing a data governance system in Iran's private sector using Soft Systems Methodology (SSM). Information Management Research Journal, 25(3), 112–130. [In Persian]
Richards, N. M., & Hartzog, W. (2021). The pathologies of digital consent. Washington University Law Review, 98(4), 1107–1156.
Riggins, F. J., & Wamba, S. F. (2021). Research directions on the adoption, usage, and impact of the Internet of Things through the use of big data analytics. Journal of Business Research, 133, 414–426.
Mortazavi, M. R., Moeini, A., & Sajedinejad, A. (2024). Data governance framework in data exchange centers. Information Management Science and Technology, 10(1), 89–116. https://doi.org/10.22091/stim.2022.7668.170 [In Persian]
Sánchez, M. (2022). A general approach on privacy and its implications in the digital economy. Journal of Economic Issues, 56(1), 123–137.
Schneier, B. (2020). Data and Goliath: The hidden battles to collect your data and control your world. W.W. Norton & Company.
Shoker, A. (2023). Digital sovereignty strategies for every nation. arXiv preprint arXiv:2307.01791.
Sivarajah, U., Irani, Z., Weerakkody, V., & Charalabidis, Y. (2021). Leveraging big data analytics for digital transformation: Challenges and opportunities. Information Systems Frontiers, 23(4), 981–1002.
Tisne, M. (2021). The data delusion: Protecting individual data isn't enough to protect individual privacy. Harvard Business Review, 99(1), 116–125.
Wang, R. Y., & Strong, D. M. (2021). Data quality and governance in the digital age. MIS Quarterly Executive, 20(3), 143–162.
Weber, B. W., & Gai, K. (2022). Blockchain and data governance: Opportunities and challenges. Journal of Information Technology, 37(1), 1–20.
Weber, R. H., & Saunders, C. (2021). Digital transformation and data governance: Emerging trends and challenges. Journal of Management Information Systems, 38(2), 456–478.
Westin, A. F. (2021). Privacy and Freedom. IG Publishing.
Yaqoob Siddiqui, S., Farooqi, S., ur Rehman, W., & Zulfiqar, L. (2024). Human rights for the digital age. arXiv preprint arXiv:2408.17302.
Zuboff, S. (2019). The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power. PublicAffairs.
Send comment about this article
CAPTCHA Image
Sciences and Techniques of Information Management
Volume 12, Issue 1
March 2026
Pages 111-123

Files

Share

How to cite

Statistics