Abstract:

The primary objective of this study was to develop an original conceptual model for the implementation of the requirements of the General Data Protection Regulation (GDPR) within the information management systems of small and medium-sized enterprises (SMEs), highlighting the horizontal impact of this regulation across the various stages and dimensions of the information process.

The study employed qualitative research methods, including a critical review of the relevant literature, as well as the methods of scientific deduction and synthesis.

The outcome of the research is an original GDPR implementation model for small and medium-sized enterprises, integrated with five dimensions of information management. The findings demonstrate that the GDPR functions as a horizontal regulator of information governance and security, extending beyond the scope of a purely formal legal obligation.