Authors : Babatunde Ogunsipe

Volume/Issue : Volume 11 - 2026, Issue 6 - June

Google Scholar : https://tinyurl.com/muvn8d8c

Scribd : https://tinyurl.com/yp8av529

DOI : https://doi.org/10.38124/ijisrt/26jun1456

Note : A published paper may take 4-5 working days from the publication date to appear in PlumX Metrics, Semantic Scholar, and ResearchGate.

Abstract : Critical infrastructure systems are becoming more digitized and interconnected, producing large amounts of data. While this digital transformation improves operational efficiency across sectors, it also raises privacy and governance issues. Current privacy regulations struggle to meet the demands of modern, complex infrastructure ecosystems. This study investigates the integration of privacy-by-design principles within critical infrastructure systems, emphasizing governance frameworks that align regulatory compliance, cybersecurity resilience, and technical system design. Findings indicate that multi-layered governance architectures, privacy impact assessments, and automated compliance technologies enable proactive management of privacy risks while maintaining system continuity. Case-based frameworks illustrate successful applications where privacy-integrated infrastructure strengthened regulatory adherence, mitigated cyber threats, and improved national resilience. The study also identifies key enablers, including enterprise risk management, workforce capacity building, and adaptive policy mechanisms, alongside challenges such as fragmented governance models, distributed computing environments, and evolving regulatory requirements. Ultimately, these efforts establish a scalable foundation for secure, privacy-resilient, and compliant critical infrastructure systems, fostering stakeholder trust and sustainable digital operations.

Keywords : Data Protection, Infrastructure Policy, Critical Systems Protection, Smart Infrastructure.

References :

1. Adeniji, O. (2025). Analysis of the Role of Artificial Intelligence under the Nigerian Criminal Justice System.
2. Agrawal, P., Singh, A., Raghavan, M., Sharma, S., & Banerjee, S. (2020). An operational architecture for privacy-by-design in public service applications. arXiv preprint arXiv:2006.04654.
3. Akbulut, S., Semantha, F. H., Azam, S., Pilares, I. C. A., Jonkman, M., Yeo, K. C., & Shanmugam, B. (2023). Designing a private and secure personal health records access management system: A solution based on IOTA distributed ledger technology. Sensors, 23(11), 5174.
4. Alcaraz, C., & Zeadally, S. (2015). Critical infrastructure protection: Requirements and challenges for the 21st century. International journal of critical infrastructure protection, 8, 53-66.
5. Alderson, D. L., Brown, G. G., & Carlyle, W. M. (2015). Operational models of infrastructure resilience. Risk Analysis, 35(4), 562-586.
6. Angel, N. A., Ravindran, D., Vincent, P. D. R., Srinivasan, K., & Hu, Y. C. (2021). Recent advances in evolving computing paradigms: Cloud, edge, and fog technologies. Sensors, 22(1), 196.
7. Ani, U. P. D., He, H., & Tiwari, A. (2017). Review of cybersecurity issues in industrial critical infrastructure: manufacturing in perspective. Journal of Cyber Security Technology, 1(1), 32-74.
8. Argyroudis, S. A., Mitoulis, S. A., Chatzi, E., Baker, J. W., Brilakis, I., Gkoumas, K., ... & Linkov, I. (2022). Digital technologies can enhance climate resilience of critical infrastructure. Climate Risk Management, 35, 100387.
9. Binns, R. (2018, January). Fairness in machine learning: Lessons from political philosophy. In Conference on fairness, accountability and transparency (pp. 149-159). PMLR.
10. Boyes, H., Hallaq, B., Cunningham, J., & Watson, T. (2018). The industrial internet of things (IIoT): An analysis framework. Computers in industry, 101, 1-12.
11. Bu, F., Wang, N., Jiang, Q., & Tian, X. (2024). Research on Privacy-by-Design behavioural Decision-Making of information engineers considering perceived work risk. Systems, 12(7), 250.
12. Cambronero, M. E., Martínez, M. A., Llana, L., Rodríguez, R. J., & Russo, A. (2024). Towards a GDPR-compliant cloud architecture with data privacy controlled through sticky policies. PeerJ Computer Science, 10, e1898.
13. Cavoukian, A. (2009). Privacy by design: The 7 foundational principles. Information and privacy commissioner of Ontario, Canada, 5(2009), 12.
14. Cherdantseva, Y., Burnap, P., Blyth, A., Eden, P., Jones, K., Soulsby, H., & Stoddart, K. (2016). A review of cyber security risk assessment methods for SCADA systems. Computers & security, 56, 1-27.
15. Chereja, I., Erdei, R., Delinschi, D., Pasca, E., Avram, A., & Matei, O. (2025). Privacy-conducive data ecosystem architecture: by-design vulnerability assessment using privacy risk expansion factor and privacy exposure index. Sensors, 25(11), 3554.
16. Cram, W. A., D’arcy, J., & Proudfoot, J. G. (2019). Seeing the Forest and the Trees: A Meta-Analysis of the Antecedents to Information Security Policy Compliance1. MIS quarterly, 43(2), 525-553.
17. Custers, B., Dechesne, F., Sears, A. M., Tani, T., & Van der Hof, S. (2018). A comparison of data protection legislation and policies across the EU. Computer Law & Security Review, 34(2), 234-243.
18. Daoudagh, S., Marchetti, E., Savarino, V., Bernabe, J. B., García-Rodríguez, J., Moreno, R. T., ... & Skarmeta, A. F. (2021). Data protection by design in the context of smart cities: A consent and access control proposal. Sensors, 21(21), 7154.
19. De Hert, P., & Papakonstantinou, V. (2016). The new General Data Protection Regulation: Still a sound system for the protection of individuals?. Computer law & security review, 32(2), 179-194.
20. Edwards, B., Hofmeyr, S., & Forrest, S. (2016). Hype and heavy tails: A closer look at data breaches. Journal of Cybersecurity, 2(1), 3-14.
21. Fernández-Alemán, J. L., Señor, I. C., Lozoya, P. Á. O., & Toval, A. (2013). Security and privacy in electronic health records: A systematic literature review. Journal of biomedical informatics, 46(3), 541-562.
22. Fioretto, F., Mak, T. W., & Van Hentenryck, P. (2019). Privacy-preserving obfuscation of critical infrastructure networks. arXiv preprint arXiv:1905.09778.
23. Greenleaf, G. (2017). Global data privacy laws 2017: 120 national data privacy laws, including Indonesia and Turkey. Including Indonesia and Turkey (January 30, 2017), 145, 10-13.
24. Gürses, S., Troncoso, C., & Diaz, C. (2011). Engineering privacy by design. Computers, Privacy & Data Protection, 14(3), 25.
25. Hoepman, J. H. (2014, June). Privacy design strategies. In IFIP International Information Security Conference (pp. 446-459). Berlin, Heidelberg: Springer Berlin Heidelberg.
26. Humayed, A., Lin, J., Li, F., & Luo, B. (2017). Cyber-physical systems security—A survey. IEEE Internet of Things Journal, 4(6), 1802-1831.
27. Husnoo, M. A., Anwar, A., Chakrabortty, R. K., Doss, R., & Ryan, M. J. (2021). Differential privacy for IoT-enabled critical infrastructure: A comprehensive survey. IEEE access, 9, 153276-153304.
28. Khan, R., Maynard, P., McLaughlin, K., Laverty, D., & Sezer, S. (2016, August). Threat analysis of blackenergy malware for synchrophasor based real-time control and monitoring in smart grid. In 4th International Symposium for ICS & SCADA Cyber Security Research 2016 (pp. 53-63). BCS.
29. Knockaert, M., Laurent, M., Malina, L., Matulevicius, R., Petrocchi, M., Seeba, M., ... & Tom, J. (2021). Privacy-by-design in intelligent infrastructures. In Deep diving into data protection: 1979-2019: celebrating 40 years of research on privacy data protection at the CRIDS (pp. 309-343). Larcier.
30. Knowles, W., Prince, D., Hutchison, D., Disso, J. F. P., & Jones, K. (2015). A survey of cyber security management in industrial control systems. International journal of critical infrastructure protection, 9, 52-80.
31. Kolade, T. M., Aideyan, N. T., Oyekunle, S. M., Ogungbemi, O. S., Dapo-Oyewole, D. L., & Olaniyi, O. O. (2024). Artificial intelligence and information governance: Strengthening global security, through compliance frameworks, and data security. Available at SSRN 5044032.
32. Koops, B. J., & Leenes, R. (2014). Privacy regulation cannot be hardcoded. A critical comment on the ‘privacy by design’provision in data-protection law. International Review of Law, Computers & Technology, 28(2), 159-171.
33. Lomas, E. (2020). Information governance and cybersecurity: Framework for securing and managing information effectively and ethically. In Cybersecurity for Information Professionals (pp. 109-130). Auerbach Publications.
34. Lund-Tønnesen, J. (2026). Digital surveillance governance: understanding developments in the use of personal data in public sector reform. Public Management Review, 1-28.
35. Mantelero, A. (2014). The future of consumer data protection in the EU Re-thinking the “notice and consent” paradigm in the new era of predictive analytics. Computer Law & Security Review, 30(6), 643-660.
36. Mantelero, A. (2018). AI and Big Data: A blueprint for a human rights, social and ethical impact assessment. Computer Law & Security Review, 34(4), 754-772.
37. Oh, K. B., Hoang, G., Sturdy, J., & Guo, S. S. (2025). Enterprise Risk Management and Cybersecurity Governance. In Cybersecurity Governance: An Enterprise Risk Management Strategy for Cyber Risk Control (pp. 65-88). Singapore: Springer Nature Singapore.
38. Okon, S. U., Olateju, O., Ogungbemi, O. S., Joseph, S., Olisa, A. O., & Olaniyi, O. O. (2024). Incorporating privacy by design principles in the modification of AI systems in preventing breaches across multiple environments, including public cloud, private cloud, and on-prem. Including Public Cloud, Private Cloud, and On-prem (September 03, 2024).
39. Perera, C., Qin, Y., Estrella, J. C., Reiff-Marganiec, S., & Vasilakos, A. V. (2017). Fog computing for sustainable smart cities: A survey. ACM Computing Surveys (CSUR), 50(3), 1-43.
40. Romanou, A. (2018). The necessity of the implementation of Privacy by Design in sectors where data protection concerns arise. Computer law & security review, 34(1), 99-110.
41. Sadiq, S., Governatori, G., & Namiri, K. (2007, September). Modeling control objectives for business process compliance. In International conference on business process management (pp. 149-164). Berlin, Heidelberg: Springer Berlin Heidelberg.
42. Schwartz, P. M. (2012). Information privacy in the cloud. U. Pa. L. Rev., 161, 1623.
43. Shikhaliyev, R. (2024). Cybersecurity risks management of industrial control systems: A review. Problems of Information Technology, 37-43.
44. Sicari, S., Rizzardi, A., Grieco, L. A., & Coen-Porisini, A. (2015). Security, privacy and trust in Internet of Things: The road ahead. Computer networks, 76, 146-164.
45. Solove, D. J. (2021). The myth of the privacy paradox. Geo. Wash. L. Rev., 89, 1.
46. Somanathan, S. (2023). Governance in cloud transformation projects: Managing security, compliance, and risk. International Journal of Applied Engineering & Technology, 5, 2O23.
47. Stallings, W. (2019). Information privacy engineering and privacy by design: Understanding privacy threats, technology, and regulations based on standards and best practices. Addison-Wesley Professional.
48. Tariq, N., Asim, M., Al-Obeidat, F., Zubair Farooqi, M., Baker, T., Hammoudeh, M., & Ghafir, I. (2019). The security of big data in fog-enabled IoT applications including blockchain: A survey. Sensors, 19(8), 1788.
49. Tedeschi, P., & Sciancalepore, S. (2019, June). Edge and fog computing in critical infrastructures: Analysis, security threats, and research challenges. In 2019 IEEE European symposium on security and privacy workshops (EuroS&PW) (pp. 1-10). IEEE.
50. Tikkinen-Piri, C., Rohunen, A., & Markkula, J. (2018). EU General Data Protection Regulation: Changes and implications for personal data collecting companies. Computer Law & Security Review, 34(1), 134-153.
51. Trim, P., & Lee, Y. I. (2016). Cyber security management: a governance, risk and compliance framework. Routledge.
52. Voigt, P., & Von dem Bussche, A. (2017). The eu general data protection regulation (gdpr). A practical guide, 1st ed., Cham: Springer International Publishing, 10(3152676), 10-5555.
53. Wachter, S., Mittelstadt, B., & Floridi, L. (2017). Why a right to explanation of automated decision-making does not exist in the general data protection regulation. International data privacy law, 7(2), 76-99.
54. Weber, R. H. (2015). Internet of things: Privacy issues revisited. Computer Law & Security Review, 31(5), 618-627.
55. Xu, Y., Liu, Y., Wu, J., & Zhan, X. (2024). Privacy by Design in Machine Learning Data Collection: An Experiment on Enhancing User Experience. Applied and Computational Engineering, 97, 64-68.
56. Yusuff, M. (2023). Privacy by Design Principles in System Architecture and Development. https://www.researchgate.net/publication/387224607_Privacy_by_Design_Principles_in_System_Architecture_and_Development