Towards Privacy-Aware IoT Audit Framework: A Grounded Theory Approach

Le résumé fourni par la source

The rapid proliferation of Internet of Things (IoT) technologies in today's electronic society has raised pressing concerns about personal data privacy. Existing audit frameworks for traditional IT systems do not adequately address the unique challenges posed by IoT environments, including continuous data collection, device heterogeneity, and limited user interfaces. Moreover, most IoT systems lack auditability by design, and no standardised mechanisms exist to assess compliance with data privacy principles. To address this gap, we developed a privacyaware IoT audit framework using Grounded Theory Analysis. In-depth interviews were conducted with ten professionals from Indonesia, a newly industrialized country that recently enacted a Personal Data Protection Law, comprising IT auditors and cybersecurity experts, to extract insights from real-world practices. Through a structured coding process (open, axial, and selective), we developed a modular framework comprising seven components: Risk Assessment, Governance, Asset Management, Security Controls, Privacy Controls, Incident Management, and Compliance Assessment. Our findings reveal that privacy considerations are frequently overlooked in current IoT audit practices. The proposed framework offers a systematic and empirically grounded approach to evaluating personal data protection in IoT systems. By embedding regulatory compliance and auditability into its design, this paper addresses a key shortcoming in current audit standards and contributes to stronger, more accountable data privacy governance in connected digital ecosystems.

Ce résumé expose les affirmations des auteurs. BNTIC ne l’interprète pas comme une validation indépendante des résultats.