Submit your papersSubmit Now
For Enquiries: [email protected]
IIARD LogoIIARD

A Conceptual Framework for Harmonizing Data Protection Compliance Across GDPR, NDPR, And United States Privacy Regimes

Michael Ominyi, Cyril Chimelie Anichukwueze

Abstract

The global expansion of digital commerce has forced multinational organizations to navigate an increasingly fragmented data protection landscape. The European Union's General Data Protection Regulation , Nigeria's Data Protection Regulation , and the patchwork of sectoral and state-level privacy statutes in the United States each impose distinct, and at times conflicting, obligations on organizations that collect and process personal data. This paper examines the structural, procedural, economic, and philosophical differences among these three regimes and argues that the resulting compliance fragmentation imposes disproportionate costs on organizations, particularly small and medium enterprises operating across borders. Drawing on comparative regulatory analysis, enforcement data, and applied compliance scholarship, the paper proposes a four-layer Convergent Data Governance Framework built on a universal core of data protection principles, a jurisdictional crosswalk mapping layer, an organizational interoperability layer, and a legal recognition and adaptive governance layer. The framework allows organizations to build a single, extensible compliance architecture that satisfies the strictest common denominator of each regime while remaining adaptable to future regulatory change, including Nigeria's evolving data protection act and ongoing United States federal privacy legislation. The paper illustrates the framework through a hypothetical multinational case study, proposes a compliance maturity model for organizational self-assessment, and concludes with practical implementation guidance and recommendations for regulators seeking greater international interoperability.

Keywords

data protectionGDPRNDPRprivacy lawregulatory harmonizationcompliance frameworkcross-border data transferenforcementcompliance maturity

References

Akomolafe, O., & Agu, M. U. (2018). A conceptual model for enhancing internal audit quality through technology-enabled risk assessment frameworks. Iconic Research and Engineering Journals, 1(9), 458–475. Akomolafe, O., & Agu, M. U. (2019a). A conceptual framework for developing risk-based internal control models in the insurance and banking sectors. Iconic Research and Engineering Journals, 2(8), 335–354. Akomolafe, O., & Agu, M. U. (2019b). A review of data-driven risk evaluation models for emerging market financial institutions. Iconic Research and Engineering Journals, 3(6), 433–448. Akomolafe, O., & Agu, M. U. (2019c). Advances in financial resilience through integrated governance and compliance strategies. Iconic Research and Engineering Journals, 2(10), 607–620. American Data Privacy and Protection Act, H.R. 8152, 117th Cong. (2022). Annan, A. O. (2022). Data privacy governance models for cross-border digital platforms. International Journal of Multidisciplinary Research and Growth Evaluation, 3(6), 949–964. Atakpa, M. I., & Abolaji, T. O. (2022). A privacy-preserving data architecture model for regulated industry analytics under GDPR and HIPAA compliance. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 8(3), 781–808. https://doi.org/10.32628/CSEIT22558 Atima, M. E., Sanni, J. O., & Attah, A. (2022). Predictive audience segmentation models resolving targeting inefficiencies in regulated professional service enterprises. Shodhshauryam, International Scientific Refereed Research Journal, 5(1), 271–303. https://doi.org/10.32628/SHISRRJ247134 Badmus, O., Dosunmu, A. A., & Ozowara, D. E. (2019). A governance framework for Salesforce platform management in regulated healthcare environments. Iconic Research and Engineering Journals, 3(6). Badmus, O., Jooda, D., Ozowara, D. E., & Anunagba, C. O. (2022). A framework for Git-based version control and code review governance in Salesforce development teams. Shodhshauryam, International Scientific Refereed Research Journal, 5(2), 473–493. Bradford, A. (2020). The Brussels effect: How the European Union rules the world. Oxford University Press. California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq. California Privacy Rights Act of 2020, Cal. Civ. Code § 1798.100 et seq. (amending the California Consumer Privacy Act). Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506 (1998). Colorado Privacy Act, Colo. Rev. Stat. §§ 6-1-1301 et seq. (2021). Connecticut Data Privacy Act, Conn. Pub. Act No. 22-15 (2022). Eze, F. I., Anene, U. N., & Akinleye, O. K. (2022a). Creation of a drug shortage early warning and regulatory response model for essential medicines in global health systems. Research Journal of Pure Science and Technology, 5(1), 57–95. https://doi.org/10.56201/rjpst.v5.no1.2022.pg57.95 Eze, F. I., Anene, U. N., & Akinleye, O. K. (2022b). Design of an integrated regulatory readiness maturity model for pharmaceutical companies seeking global market entry. International Journal of Health and Pharmaceutical Research, 7(1), 77–112. https://doi.org/10.56201/ijhpr.v7.no1.2022.pg77.112 Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809 (1999). Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936. Kuner, C. (2013). Transborder data flows and data privacy law. Oxford University Press. Lawal, O. A., & Oduleye, T. E. (2018). A review and conceptual framework for tax governance and cross-border compliance analytics. Iconic Research and Engineering Journals, 2(5). Mbonu, I. S., Aliliele, C., Iwuanyanwu, U., & Oluoha, O. M. (2018). A conceptual framework for legal and ethical risk modeling in enterprise data protection governance systems. Iconic Research and Engineering Journals, 2(2), 207–226. https://doi.org/10.64388/IREV2I2- 1714911 Mbonu, I. S., Aliliele, C., Iwuanyanwu, U., & Uzoka, E. (2020a). A review of identity and access management integration strategies in hybrid and multi cloud environments. International Journal of Multidisciplinary Research and Growth Evaluation, 1(5), 795–810. https://doi.org/10.54660/.IJMRGE.2020.1.5.795-810 Mbonu, I. S., Aliliele, C., Iwuanyanwu, U., & Uzoka, E. (2021a). A conceptual framework for risk based business intelligence architecture in financial technology platforms. International Journal of Multidisciplinary Research and Growth Evaluation, 2(6), 731–746. https://doi.org/10.54660/.IJMRGE.2021.2.6.731-746 Mbonu, I. S., Aliliele, C., Iwuanyanwu, U., & Uzoka, E. (2022b). A conceptual framework for AI enabled IT general controls and SOX audit automation processes. Gyanshauryam, International Scientific Refereed Research Journal, 5(5), 384–414. https://doi.org/10.32628/GISRRJ2256239 Mbonu, I. S., Aliliele, C., Uzoka, E., & Oluoha, O. M. (2019). A review of comparative data protection regulations and secure cloud implementation strategies across jurisdictions. Iconic Research and Engineering Journals, 2(9), 482–501. https://doi.org/10.64388/IREV2I9-1714912 Mbonu, I. S., Iwuanyanwu, U., Aliliele, C., & Uzoka, E. (2020b). Advances in infrastructure as code governance for secure terraform based enterprise cloud deployments. International Journal of Multidisciplinary Research and Growth Evaluation, 1(5), 811–828. https://doi.org/10.54660/.IJMRGE.2020.1.5.811-828 Mbonu, I. S., Iwuanyanwu, U., Aliliele, C., & Uzoka, E. (2021). A review of VoIP forensic analytics models for financial fraud detection and regulatory compliance monitoring. International Journal of Multidisciplinary Research and Growth Evaluation, 2(6), 711–730. https://doi.org/10.54660/.IJMRGE.2021.2.6.711-730 Mbonu, I. S., Iwuanyanwu, U., Aliliele, C., & Uzoka, E. (2022a). A review of data protection impact assessment models in multi cloud financial infrastructure systems. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 8(1), 589–623. https://doi.org/10.32628/CSEIT25442 Mbonu, I. S., Iwuanyanwu, U., Aliliele, C., & Uzoka, E. (2022c). Advances in cloud identity and access governance optimization in large scale AWS enterprise environments. Shodhshauryam, International Scientific Refereed Research Journal, 5(3), 403–438. https://doi.org/10.32628/SHISRRJ225490 National Information Technology Development Agency. (2019). Nigeria Data Protection Regulation. National Information Technology Development Agency. (2020). Nigeria Data Protection Regulation implementation framework. Organisation for Economic Co-operation and Development. (2013). OECD guidelines governing the protection of privacy and transborder flows of personal data (rev. ed.). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation). Schwartz, P. M. (2019). Global data privacy: The EU way. New York University Law Review, 94(4), 771–818. Solove, D. J. (2008). Understanding privacy. Harvard University Press. United Nations Conference on Trade and Development. (2022). Data protection and privacy legislation worldwide. Utah Consumer Privacy Act, Utah Code Ann. §§ 13-61-101 et seq. (2022). Virginia Consumer Data Protection Act, Va. Code Ann. §§ 59.1-575 et seq. (2021).

More Articles from INTERNATIONAL JOURNAL OF SOCIAL SCIENCES AND MANAGEMENT RESEARCH