EVOLVING LEGAL PARADIGMS IN CYBERSECURITY AND DATA PROTECTION GOVERNANCE

Abstract

Cybersecurity and data protection have become core concerns of modern governance as states, corporations, and individuals navigate a digital environment marked by unprecedented risks and opportunities. Over the last decade, legal regimes governing cybersecurity and data privacy have shifted from fragmented, sectorspecific rules to more comprehensive regulatory frameworks. This paper examines the evolution of these frameworks through a doctrinal and normative lens, focusing on the European Union’s General Data Protection Regulation (GDPR), the United States’ patchwork of federal and state laws, and emerging regimes in Asia, Africa, and Latin America. It traces how international norms such as data sovereignty, privacy-by-design, and risk-based regulation have influenced domestic lawmaking, and evaluates the effectiveness and legitimacy of these legal paradigms in balancing security and privacy. The study concludes that while considerable progress has been made in developing robust data protection and cybersecurity laws, significant challenges remain, including jurisdictional fragmentation, uneven enforcement, and the need for harmonised standards capable of addressing cross-border data flows and cyber threats.