{"id":"https://openalex.org/W7084748617","doi":"https://doi.org/10.5281/zenodo.17254610","title":"Privacy, Data Protection, Risk, and Compliance in the Age of Generative AI Systems: A Systematic Mapping Study","display_name":"Privacy, Data Protection, Risk, and Compliance in the Age of Generative AI Systems: A Systematic Mapping Study","publication_year":2025,"publication_date":"2025-10-03","ids":{"openalex":"https://openalex.org/W7084748617","doi":"https://doi.org/10.5281/zenodo.17254610"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.17254610","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.17254610","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"},"type":"dataset","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.17254610","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Richardson B. da S. Andrade","orcid":"https://orcid.org/0000-0002-4329-6345"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Richardson B. da S. Andrade","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0000-0002-4329-6345","affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Geraldo Pereira Rocha Filho","orcid":"https://orcid.org/0000-0001-6795-2768"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Geraldo Pereira Rocha Filho","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0000-0001-6795-2768","affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Gilmar dos Santos Marques","orcid":"https://orcid.org/0000-0001-5900-3749"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gilmar dos Santos Marques","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0000-0001-5900-3749","affiliations":[]},{"author_position":"last","author":{"id":null,"display_name":"Edna Dias Canedo","orcid":"https://orcid.org/0000-0002-2159-339X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Edna Dias Canedo","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0000-0002-2159-339X","affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":true,"primary_topic":{"id":"https://openalex.org/T11636","display_name":"Artificial Intelligence in Healthcare and Education","score":0.24469999969005585,"subfield":{"id":"https://openalex.org/subfields/2718","display_name":"Health Informatics"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}},"topics":[{"id":"https://openalex.org/T11636","display_name":"Artificial Intelligence in Healthcare and Education","score":0.24469999969005585,"subfield":{"id":"https://openalex.org/subfields/2718","display_name":"Health Informatics"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}},{"id":"https://openalex.org/T10883","display_name":"Ethics and Social Impacts of AI","score":0.18539999425411224,"subfield":{"id":"https://openalex.org/subfields/3311","display_name":"Safety Research"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T14347","display_name":"Big Data and Digital Economy","score":0.049300000071525574,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/sociotechnical-system","display_name":"Sociotechnical system","score":0.647599995136261},{"id":"https://openalex.org/keywords/quality","display_name":"Quality (philosophy)","score":0.436599999666214},{"id":"https://openalex.org/keywords/general-data-protection-regulation","display_name":"General Data Protection Regulation","score":0.42640000581741333},{"id":"https://openalex.org/keywords/data-protection-act-1998","display_name":"Data Protection Act 1998","score":0.41179999709129333},{"id":"https://openalex.org/keywords/data-quality","display_name":"Data quality","score":0.39489999413490295},{"id":"https://openalex.org/keywords/systematic-review","display_name":"Systematic review","score":0.3889000117778778},{"id":"https://openalex.org/keywords/risk-management","display_name":"Risk management","score":0.3797999918460846},{"id":"https://openalex.org/keywords/transformative-learning","display_name":"Transformative learning","score":0.37689998745918274},{"id":"https://openalex.org/keywords/trustworthiness","display_name":"Trustworthiness","score":0.3749000132083893},{"id":"https://openalex.org/keywords/inclusion","display_name":"Inclusion (mineral)","score":0.3747999966144562}],"concepts":[{"id":"https://openalex.org/C127627568","wikidata":"https://www.wikidata.org/wiki/Q1639361","display_name":"Sociotechnical system","level":2,"score":0.647599995136261},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5031999945640564},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.436599999666214},{"id":"https://openalex.org/C3090818","wikidata":"https://www.wikidata.org/wiki/Q1172506","display_name":"General Data Protection Regulation","level":3,"score":0.42640000581741333},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.42250001430511475},{"id":"https://openalex.org/C69360830","wikidata":"https://www.wikidata.org/wiki/Q1172237","display_name":"Data Protection Act 1998","level":2,"score":0.41179999709129333},{"id":"https://openalex.org/C24756922","wikidata":"https://www.wikidata.org/wiki/Q1757694","display_name":"Data quality","level":3,"score":0.39489999413490295},{"id":"https://openalex.org/C189708586","wikidata":"https://www.wikidata.org/wiki/Q1504425","display_name":"Systematic review","level":3,"score":0.3889000117778778},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.3797999918460846},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.37770000100135803},{"id":"https://openalex.org/C70587473","wikidata":"https://www.wikidata.org/wiki/Q7834111","display_name":"Transformative learning","level":2,"score":0.37689998745918274},{"id":"https://openalex.org/C153701036","wikidata":"https://www.wikidata.org/wiki/Q659974","display_name":"Trustworthiness","level":2,"score":0.3749000132083893},{"id":"https://openalex.org/C109359841","wikidata":"https://www.wikidata.org/wiki/Q728944","display_name":"Inclusion (mineral)","level":2,"score":0.3747999966144562},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.373199999332428},{"id":"https://openalex.org/C2781460075","wikidata":"https://www.wikidata.org/wiki/Q1399332","display_name":"Compliance (psychology)","level":2,"score":0.3720000088214874},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.37130001187324524},{"id":"https://openalex.org/C2776945810","wikidata":"https://www.wikidata.org/wiki/Q17006654","display_name":"Data anonymization","level":3,"score":0.3621000051498413},{"id":"https://openalex.org/C539667460","wikidata":"https://www.wikidata.org/wiki/Q2414942","display_name":"Management science","level":1,"score":0.3400000035762787},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.3264999985694885},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.3230000138282776},{"id":"https://openalex.org/C482391","wikidata":"https://www.wikidata.org/wiki/Q101244","display_name":"Acronym","level":2,"score":0.3066999912261963},{"id":"https://openalex.org/C2780224610","wikidata":"https://www.wikidata.org/wiki/Q1530061","display_name":"Credibility","level":2,"score":0.3050000071525574},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.2971000075340271},{"id":"https://openalex.org/C39890363","wikidata":"https://www.wikidata.org/wiki/Q36108","display_name":"Generative grammar","level":2,"score":0.29260000586509705},{"id":"https://openalex.org/C517642484","wikidata":"https://www.wikidata.org/wiki/Q2388514","display_name":"Intelligence analysis","level":2,"score":0.290800005197525},{"id":"https://openalex.org/C180198813","wikidata":"https://www.wikidata.org/wiki/Q121182","display_name":"Information system","level":2,"score":0.28290000557899475},{"id":"https://openalex.org/C2780589192","wikidata":"https://www.wikidata.org/wiki/Q7285140","display_name":"Raising (metalworking)","level":2,"score":0.271699994802475},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.26579999923706055},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.2632000148296356},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.26089999079704285},{"id":"https://openalex.org/C2779777834","wikidata":"https://www.wikidata.org/wiki/Q4202277","display_name":"Enforcement","level":2,"score":0.2540999948978424},{"id":"https://openalex.org/C167966045","wikidata":"https://www.wikidata.org/wiki/Q5532625","display_name":"Generative model","level":3,"score":0.2533999979496002},{"id":"https://openalex.org/C196879817","wikidata":"https://www.wikidata.org/wiki/Q872685","display_name":"Data governance","level":4,"score":0.2515000104904175}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.5281/zenodo.17254610","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.17254610","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Dataset"}],"best_oa_location":{"id":"doi:10.5281/zenodo.17254610","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.17254610","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/10","display_name":"Reduced inequalities","score":0.7686136364936829}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Research":[0,160],"Context:":[1],"Generative":[2],"Artificial":[3],"Intelligence":[4],"(GenAI),":[5],"particularly":[6],"Large":[7],"Language":[8],"Models":[9],"(LLMs),":[10],"has":[11],"advanced":[12],"rapidly":[13],"across":[14],"domains,":[15],"raising":[16],"concerns":[17],"about":[18],"privacy,":[19,218,266],"data":[20,139],"protection,":[21],"risk":[22,100,227],"management,":[23],"and":[24,34,39,46,58,68,80,103,117,143,154,183,186,199,223,237,251,255,268,280,286,293,300],"regulatory":[25,63,155,252,301],"compliance.":[26],"Despite":[27],"its":[28],"transformative":[29],"potential,":[30],"adoption":[31],"remains":[32],"immature":[33],"challenged":[35],"by":[36,141],"ethical,":[37],"technical,":[38],"legal":[40,81,281],"limitations.":[41],"Practical":[42],"Problem:":[43],"Organizations,":[44],"developers,":[45],"end":[47],"users":[48],"face":[49],"increasing":[50],"risks":[51],"of":[52,60,135,157,206,214,277],"privacy":[53],"violations,":[54],"re-identification,":[55],"model":[56],"inversion,":[57],"lack":[59],"transparency.":[61],"Current":[62],"frameworks":[64,229],"such":[65],"as":[66],"GDPR":[67],"LGPD":[69],"struggle":[70],"to":[71,107,257,264],"address":[72,265],"GenAI\u2019s":[73],"complexity,":[74],"leaving":[75],"gaps":[76,273],"between":[77,247],"technical":[78,248,278],"mechanisms":[79,239,263],"requirements.":[82,282],"Proposed":[83],"Solution:":[84],"To":[85],"better":[86],"understand":[87],"these":[88],"challenges,":[89],"we":[90,167],"conducted":[91],"a":[92,163],"systematic":[93,164],"mapping":[94,165],"study":[95,130,261],"focused":[96],"on":[97],"privacy-preserving":[98,215],"mechanisms,":[99],"management":[101,228],"frameworks,":[102],"compliance":[104,238,269],"models":[105],"applicable":[106],"GenAI":[108],"systems.":[109,159,306],"Our":[110],"analysis":[111],"identifies":[112],"state-of-the-art":[113],"approaches,":[114,222],"their":[115],"advantages,":[116],"limitations,":[118],"highlighting":[119,272],"how":[120],"they":[121],"may":[122],"support":[123],"trustworthy":[124],"adoption.":[125],"Related":[126],"IS":[127,258,295],"Theory:":[128],"The":[129,208],"is":[131],"grounded":[132],"in":[133,197,270,288],"theories":[134],"information":[136,158,305],"systems":[137,292],"governance,":[138],"protection":[140],"design,":[142],"responsible":[144,290],"AI,":[145],"aligned":[146],"with":[147],"sociotechnical":[148],"perspectives":[149],"that":[150],"integrate":[151],"technological,":[152],"organizational,":[153],"aspects":[156],"Method:":[161],"Following":[162],"protocol,":[166],"searched":[168],"four":[169,211],"major":[170],"digital":[171],"libraries":[172],"(ACM":[173],"DL,":[174],"IEEE":[175],"Xplore,":[176],"ScienceDirect,":[177],"Springer":[178],"Link),":[179],"applied":[180],"predefined":[181],"inclusion":[182],"exclusion":[184],"criteria,":[185],"performed":[187],"quality":[188,203],"assessment.":[189],"From":[190],"1,138":[191],"initial":[192],"studies,":[193],"44":[194],"were":[195],"analyzed":[196],"depth,":[198],"15":[200],"met":[201],"all":[202],"thresholds.":[204],"Summary":[205],"Results:":[207],"findings":[209],"indicate":[210],"main":[212],"categories":[213],"techniques":[216],"(differential":[217],"federated":[219],"learning,":[220],"cryptographic":[221],"synthetic":[224],"data),":[225],"five":[226],"(e.g.,":[230],"NIST":[231],"AI":[232,235,291],"RMF,":[233],"MITRE":[234],"Security),":[236],"(DPIA,":[240],"CA,":[241],"FRIA).":[242],"Comparative":[243],"analyses":[244],"reveal":[245],"trade-offs":[246],"robustness,":[249],"scalability,":[250],"alignment.":[253],"Contributions":[254],"Impact":[256],"area:":[259],"This":[260],"consolidates":[262],"risk,":[267],"GenAI,":[271],"at":[274],"the":[275],"intersection":[276],"safeguards":[279],"It":[283],"supports":[284],"scholars":[285],"practitioners":[287],"designing":[289],"informs":[294],"research":[296],"agendas,":[297],"organizational":[298],"policies,":[299],"strategies":[302],"for":[303],"intelligent":[304]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2025-10-10T00:00:00"}