(untitled) (International Journal of Engineering and Computer Science, 2025)
The article examines theoretical and practical aspects of managing risks associated with personal data breaches in modern digital ecosystems characterized by complex architectures and numerous distributed services. The study highlights the role of the digital economy, demonstrating that the growing number of mobile devices, cloud platforms, and IoT devices significantly increases the likelihood of unauthorized access to sensitive information. Key regulatory acts and standards were analyzed, including widely recognized U.S. federal laws (such as the Privacy Act of 1974, the Electronic Communications Privacy Act, the Health Insurance Portability and Accountability Act, and the Gramm-Leach-Bliley Act) and international standards (ISO/IEC 27001, ISO/IEC 27701). Additionally, various industry-specific guidelines and research articles published in leading scientific journals were examined. Particular attention is given to information security management systems (ISMS) based on formalized risk assessment methodologies (OCTAVE, CRAMM, ISO/IEC 27005) and modern technologies (DLP, SIEM, IDS/IPS). The findings demonstrate that the most effective approach is a comprehensive one, encompassing organizational, legal, and technical measures, along with the mandatory regular updating of security policies in response to current cyber threats. The analysis underscores the importance of considering industry-specific factors (finance, healthcare, industrial IoT) and the human factor, as the degree of staff involvement and competence often determines the overall effectiveness of protection systems. In conclusion, it is asserted that achieving reliable protection of personal data requires not only compliance with formal requirements but also continuous monitoring, staff training, and proactive measures against emerging types of attacks. This article is intended for information security professionals, as well as managers and specialists responsible for safeguarding confidential data in organizations operating within digital ecosystems and facing threats of personal data breaches.