{"id":"https://openalex.org/W7160271809","doi":"https://doi.org/10.5753/sbsi.2026.248735","title":"Privacy, Data Protection, Risk, and Compliance in the Age of Generative AI Systems: A Systematic Mapping Study","display_name":"Privacy, Data Protection, Risk, and Compliance in the Age of Generative AI Systems: A Systematic Mapping Study","publication_year":2026,"publication_date":"2026-05-05","ids":{"openalex":"https://openalex.org/W7160271809","doi":"https://doi.org/10.5753/sbsi.2026.248735"},"language":null,"primary_location":{"id":"doi:10.5753/sbsi.2026.248735","is_oa":true,"landing_page_url":"https://doi.org/10.5753/sbsi.2026.248735","pdf_url":"https://sol.sbc.org.br/index.php/sbsi/article/download/41374/41144","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Anais do XXII Simp\u00f3sio Brasileiro de Sistemas de Informa\u00e7\u00e3o (SBSI 2026)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://sol.sbc.org.br/index.php/sbsi/article/download/41374/41144","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5135394993","display_name":"Richardson B. da S. Andrade","orcid":null},"institutions":[{"id":"https://openalex.org/I4210131964","display_name":"Universitas Nusa Bangsa","ror":"https://ror.org/03n5w2v49","country_code":"ID","type":"education","lineage":["https://openalex.org/I4210131964"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Richardson B. da S. Andrade","raw_affiliation_strings":["UnB"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UnB","institution_ids":["https://openalex.org/I4210131964"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059135961","display_name":"GERALDO PEREIRA ROCHA FILHO","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Geraldo Pereira Rocha Filho","raw_affiliation_strings":["UESB"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UESB","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135416330","display_name":"Gilmar dos Santos Marques","orcid":null},"institutions":[{"id":"https://openalex.org/I4210131964","display_name":"Universitas Nusa Bangsa","ror":"https://ror.org/03n5w2v49","country_code":"ID","type":"education","lineage":["https://openalex.org/I4210131964"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Gilmar dos Santos Marques","raw_affiliation_strings":["UnB"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UnB","institution_ids":["https://openalex.org/I4210131964"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5000905065","display_name":"Edna Dias Canedo","orcid":"https://orcid.org/0000-0002-2159-339X"},"institutions":[{"id":"https://openalex.org/I4210131964","display_name":"Universitas Nusa Bangsa","ror":"https://ror.org/03n5w2v49","country_code":"ID","type":"education","lineage":["https://openalex.org/I4210131964"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Edna Dias Canedo","raw_affiliation_strings":["UnB"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UnB","institution_ids":["https://openalex.org/I4210131964"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.48841263,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1182","last_page":"1201"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11636","display_name":"Artificial Intelligence in Healthcare and Education","score":0.2987000048160553,"subfield":{"id":"https://openalex.org/subfields/2718","display_name":"Health Informatics"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}},"topics":[{"id":"https://openalex.org/T11636","display_name":"Artificial Intelligence in Healthcare and Education","score":0.2987000048160553,"subfield":{"id":"https://openalex.org/subfields/2718","display_name":"Health Informatics"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}},{"id":"https://openalex.org/T10883","display_name":"Ethics and Social Impacts of AI","score":0.13079999387264252,"subfield":{"id":"https://openalex.org/subfields/3311","display_name":"Safety Research"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T14347","display_name":"Big Data and Digital Economy","score":0.0674000009894371,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/sociotechnical-system","display_name":"Sociotechnical system","score":0.6312999725341797},{"id":"https://openalex.org/keywords/compliance","display_name":"Compliance (psychology)","score":0.4629000127315521},{"id":"https://openalex.org/keywords/general-data-protection-regulation","display_name":"General Data Protection Regulation","score":0.4359000027179718},{"id":"https://openalex.org/keywords/data-protection-act-1998","display_name":"Data Protection Act 1998","score":0.4339999854564667},{"id":"https://openalex.org/keywords/information-privacy","display_name":"Information privacy","score":0.4334999918937683},{"id":"https://openalex.org/keywords/conformity-assessment","display_name":"Conformity assessment","score":0.4325000047683716},{"id":"https://openalex.org/keywords/inclusion","display_name":"Inclusion (mineral)","score":0.41929998993873596},{"id":"https://openalex.org/keywords/risk-management","display_name":"Risk management","score":0.4032999873161316},{"id":"https://openalex.org/keywords/best-practice","display_name":"Best practice","score":0.4000999927520752}],"concepts":[{"id":"https://openalex.org/C127627568","wikidata":"https://www.wikidata.org/wiki/Q1639361","display_name":"Sociotechnical system","level":2,"score":0.6312999725341797},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.47850000858306885},{"id":"https://openalex.org/C2781460075","wikidata":"https://www.wikidata.org/wiki/Q1399332","display_name":"Compliance (psychology)","level":2,"score":0.4629000127315521},{"id":"https://openalex.org/C3090818","wikidata":"https://www.wikidata.org/wiki/Q1172506","display_name":"General Data Protection Regulation","level":3,"score":0.4359000027179718},{"id":"https://openalex.org/C69360830","wikidata":"https://www.wikidata.org/wiki/Q1172237","display_name":"Data Protection Act 1998","level":2,"score":0.4339999854564667},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.4334999918937683},{"id":"https://openalex.org/C5911748","wikidata":"https://www.wikidata.org/wiki/Q4072285","display_name":"Conformity assessment","level":2,"score":0.4325000047683716},{"id":"https://openalex.org/C109359841","wikidata":"https://www.wikidata.org/wiki/Q728944","display_name":"Inclusion (mineral)","level":2,"score":0.41929998993873596},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.4171999990940094},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.4032999873161316},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.4000999927520752},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.3968000113964081},{"id":"https://openalex.org/C70587473","wikidata":"https://www.wikidata.org/wiki/Q7834111","display_name":"Transformative learning","level":2,"score":0.387800008058548},{"id":"https://openalex.org/C153701036","wikidata":"https://www.wikidata.org/wiki/Q659974","display_name":"Trustworthiness","level":2,"score":0.3831999897956848},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3671000003814697},{"id":"https://openalex.org/C142172996","wikidata":"https://www.wikidata.org/wiki/Q221284","display_name":"Conformity","level":2,"score":0.34529998898506165},{"id":"https://openalex.org/C24756922","wikidata":"https://www.wikidata.org/wiki/Q1757694","display_name":"Data quality","level":3,"score":0.3416999876499176},{"id":"https://openalex.org/C539667460","wikidata":"https://www.wikidata.org/wiki/Q2414942","display_name":"Management science","level":1,"score":0.328900009393692},{"id":"https://openalex.org/C2776945810","wikidata":"https://www.wikidata.org/wiki/Q17006654","display_name":"Data anonymization","level":3,"score":0.3285999894142151},{"id":"https://openalex.org/C179420905","wikidata":"https://www.wikidata.org/wiki/Q223871","display_name":"Mediation","level":2,"score":0.3273000121116638},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.31529998779296875},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.31290000677108765},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.3043999969959259},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.2969000041484833},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.29260000586509705},{"id":"https://openalex.org/C141972696","wikidata":"https://www.wikidata.org/wiki/Q1247836","display_name":"Privacy law","level":4,"score":0.27730000019073486},{"id":"https://openalex.org/C193934123","wikidata":"https://www.wikidata.org/wiki/Q7246028","display_name":"Privacy by Design","level":3,"score":0.27300000190734863},{"id":"https://openalex.org/C189708586","wikidata":"https://www.wikidata.org/wiki/Q1504425","display_name":"Systematic review","level":3,"score":0.26969999074935913},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.2572000026702881},{"id":"https://openalex.org/C2778414658","wikidata":"https://www.wikidata.org/wiki/Q1409206","display_name":"Model risk","level":3,"score":0.2515999972820282}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.5753/sbsi.2026.248735","is_oa":true,"landing_page_url":"https://doi.org/10.5753/sbsi.2026.248735","pdf_url":"https://sol.sbc.org.br/index.php/sbsi/article/download/41374/41144","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Anais do XXII Simp\u00f3sio Brasileiro de Sistemas de Informa\u00e7\u00e3o (SBSI 2026)","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.5753/sbsi.2026.248735","is_oa":true,"landing_page_url":"https://doi.org/10.5753/sbsi.2026.248735","pdf_url":"https://sol.sbc.org.br/index.php/sbsi/article/download/41374/41144","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Anais do XXII Simp\u00f3sio Brasileiro de Sistemas de Informa\u00e7\u00e3o (SBSI 2026)","raw_type":"proceedings-article"},"sustainable_development_goals":[{"display_name":"Reduced inequalities","score":0.7748123407363892,"id":"https://metadata.un.org/sdg/10"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320322025","display_name":"Conselho Nacional de Desenvolvimento Cient\u00edfico e Tecnol\u00f3gico","ror":"https://ror.org/03swz6y49"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7160271809.pdf","grobid_xml":"https://content.openalex.org/works/W7160271809.grobid-xml"},"referenced_works_count":61,"referenced_works":["https://openalex.org/W1999798506","https://openalex.org/W2124493593","https://openalex.org/W2406495567","https://openalex.org/W3012140936","https://openalex.org/W3023244064","https://openalex.org/W3033511014","https://openalex.org/W3088349136","https://openalex.org/W3091870957","https://openalex.org/W3128515475","https://openalex.org/W3134155506","https://openalex.org/W4205423013","https://openalex.org/W4213044365","https://openalex.org/W4224227775","https://openalex.org/W4284893082","https://openalex.org/W4309756158","https://openalex.org/W4379620248","https://openalex.org/W4380319827","https://openalex.org/W4382398013","https://openalex.org/W4385452929","https://openalex.org/W4385469325","https://openalex.org/W4386082956","https://openalex.org/W4386141641","https://openalex.org/W4390427686","https://openalex.org/W4390536826","https://openalex.org/W4391857516","https://openalex.org/W4392106982","https://openalex.org/W4393170828","https://openalex.org/W4394900888","https://openalex.org/W4396653761","https://openalex.org/W4396661157","https://openalex.org/W4396757578","https://openalex.org/W4396833271","https://openalex.org/W4399116034","https://openalex.org/W4399206055","https://openalex.org/W4399255051","https://openalex.org/W4399364896","https://openalex.org/W4400461381","https://openalex.org/W4400977844","https://openalex.org/W4401209860","https://openalex.org/W4401509761","https://openalex.org/W4401705300","https://openalex.org/W4403127830","https://openalex.org/W4403599869","https://openalex.org/W4404518650","https://openalex.org/W4404642803","https://openalex.org/W4405021351","https://openalex.org/W4405846684","https://openalex.org/W4406119201","https://openalex.org/W4407361832","https://openalex.org/W4408181563","https://openalex.org/W4409169101","https://openalex.org/W4409311221","https://openalex.org/W4410068348","https://openalex.org/W4410158732","https://openalex.org/W4411550487","https://openalex.org/W4412537625","https://openalex.org/W4412878139","https://openalex.org/W4413061304","https://openalex.org/W4413155465","https://openalex.org/W4413181258","https://openalex.org/W4413293038"],"related_works":[],"abstract_inverted_index":{"Research":[0,142],"Context:":[1],"Generative":[2],"Artificial":[3],"Intelligence":[4],"(GenAI),":[5],"particularly":[6],"Large":[7],"Language":[8],"Models":[9],"(LLMs),":[10],"is":[11,121],"advancing":[12],"rapidly,":[13],"raising":[14],"concerns":[15],"about":[16],"privacy,":[17,194,242],"data":[18],"protection,":[19],"risk":[20,92,202],"management,":[21],"and":[22,31,36,45,56,63,76,95,107,109,130,139,161,164,177,212,226,230,244,253,256,266,272,279],"regulatory":[23,140,227,280],"compliance.":[24],"Despite":[25],"transformative":[26],"potential,":[27],"adoption":[28],"remains":[29],"immature":[30],"constrained":[32],"by":[33,128],"ethical,":[34],"technical,":[35],"legal":[37,77,254],"limits.":[38],"Scientific":[39],"and/or":[40,81],"Practical":[41],"Problem:":[42],"Organizations,":[43],"developers,":[44],"end":[46],"users":[47],"face":[48],"risks":[49],"of":[50,183,190],"privacy":[51,127,191],"violations,":[52],"re-identification,":[53],"model":[54],"inversion,":[55],"opacity.":[57],"Current":[58],"frameworks":[59,204],"such":[60],"as":[61],"GDPR":[62],"Brazil\u2019s":[64],"LGPD":[65],"struggle":[66],"to":[67,99,232],"address":[68],"GenAI\u2019s":[69],"complexity,":[70],"leaving":[71],"gaps":[72,249],"between":[73,250],"technical":[74,251],"safeguards":[75,252],"obligations.":[78],"Proposed":[79],"Solution":[80],"Analysis:":[82],"We":[83,101,185],"performed":[84],"a":[85,145],"systematic":[86],"mapping":[87],"focused":[88],"on":[89],"privacy-preserving":[90],"mechanisms,":[91],"management":[93,203],"frameworks,":[94],"compliance":[96,213,245],"models":[97],"applicable":[98],"GenAI.":[100],"synthesize":[102],"state-of-the-art":[103],"approaches,":[104,198],"their":[105],"strengths":[106],"limitations,":[108],"assess":[110],"how":[111],"they":[112],"enable":[113],"trustworthy":[114,261],"adoption.":[115],"Related":[116],"IS":[117,234,274],"Theory:":[118],"The":[119],"study":[120,237],"grounded":[122],"in":[123,175,246,268],"information":[124,284],"systems":[125],"governance,":[126],"design,":[129],"responsible":[131,270],"AI,":[132],"using":[133],"sociotechnical":[134],"lenses":[135],"integrating":[136],"technological,":[137],"organizational,":[138],"perspectives.":[141],"Method:":[143],"Following":[144],"protocol,":[146],"we":[147],"searched":[148],"four":[149,187],"major":[150],"digital":[151],"libraries":[152],"(ACM":[153],"DL,":[154],"IEEE":[155],"Xplore,":[156],"ScienceDirect,":[157],"SpringerLink),":[158],"applied":[159],"inclusion":[160],"exclusion":[162],"criteria,":[163],"conducted":[165],"quality":[166],"assessment.":[167],"From":[168],"1,138":[169],"initial":[170],"studies,":[171],"44":[172],"were":[173],"analyzed":[174],"depth,":[176],"15":[178],"met":[179],"all":[180],"thresholds.":[181],"Summary":[182],"Results:":[184],"identify":[186],"principal":[188],"categories":[189],"techniques":[192],"(differential":[193],"federated":[195],"learning,":[196],"cryptographic":[197],"synthetic":[199],"data),":[200],"five":[201],"(e.g.,":[205],"NIST":[206],"AI":[207,271],"RMF,":[208],"MITRE":[209],"ATLAS/AI":[210],"Security),":[211],"instruments":[214],"(DPIA,":[215],"conformity":[216],"assessment,":[217],"FRIA).":[218],"Comparative":[219],"analyses":[220],"reveal":[221],"trade-offs":[222],"among":[223],"robustness,":[224],"scalability,":[225],"alignment.":[228],"Contributions":[229],"Impact":[231],"the":[233],"area:":[235],"This":[236],"consolidates":[238],"mechanisms":[239],"for":[240,260,282],"addressing":[241],"risk,":[243],"GenAI,":[247],"highlights":[248],"requirements,":[255],"distills":[257],"design":[258],"implications":[259],"systems.":[262,285],"It":[263],"supports":[264],"scholars":[265],"practitioners":[267],"engineering":[269],"informs":[273],"research":[275],"agendas,":[276],"organizational":[277],"policies,":[278],"strategies":[281],"intelligent":[283]},"counts_by_year":[],"updated_date":"2026-06-17T06:14:20.161405","created_date":"2026-05-06T00:00:00"}