The evolution of mobile cybersecurity regulations in the European Union

In order to examine thematic trends in scholarly research related to cybersecurity and the EU we used latent Dirichlet allocation (LDA) (Blei et al., 2003), on a dataset of 40 peer-reviewed scholarly research articles identified from the Web of Science database. The data were analyzed with LDA to uncover latent topics that captured the important areas within the scholarly debate regarding EU cybersecurity.

We extracted articles in PDF form and used the pdftools package in R to convert the articles to text files. The text was converted to lowercase, and punctuation and nonalphabetic characters were removed. Stopwords were removed using the tm package and by using a list of terms to filter unique and recurring words. We created a document term matrix of words that were three characters or greater. The LDA modeling used Gibbs sampling through the topic models package in R. The LDA was set to iterate out 2,000 with a burn of 1,000. We did experimental runs to select k (the number of topics), with k = 5 on the first run. While it returned promising results, the thematic elements were overlapping considerably. A revised model applied with k = 3 topics returned themes that are more coherent and interpretable.

For interpretability purposes, we used LDAvis to allow interaction with the topic structure and terms of interest. In LDA, the λ parameter is used to determine the priority and relevance of terms by topic:

λ = 1.0 prioritizes the most frequent words in a topic;

We primarily interpreted topics using λ = 0.6 and further examined λ values between 0.2 and 0.4 to surface distinctive terms. The resulting topics reflect three distinct but interrelated themes in cybersecurity research.

2.3.1

Topic 1: Strategic and policy-level cyber governance

Top distinctive terms: strategy, policy, commission, digital, international

This theme reflects policy debates at a strategic level for the governance of cybersecurity emphasizing a global dimension, international policy circumstances, and the European Commission’s role in developing strategy (Figure 1).

Figure 1

Topic 1: Strategic & Policy-Level Cyber Governance.

2.3.2

Topic 2: Cybersecurity law & regulation (EU)

Top distinctive terms: directive, nis, law, regulation, article, protection, european

This subject reflects the regulatory and legal instrumentation of cybersecurity, in the EU. The frequent appearance of “NIS,” “directive,” and “law” indicates attention to compliance, risk management, and governance instrumentation at the European level (Figure 2).

Figure 2

Topic 2: Cybersecurity Law & Regulation (EU).

2.3.3

Topic 3: Skills & technical capacity building

Top distinctive terms: certification, training, education, skills, iot, national

This topic discusses both the human and technical capacity of cybersecurity, with a focus on education, certification, and the development of workforce skills. The terms IoT and https together suggest increasing importance within the literature on technological readiness, and secure digital environments (Figure 3).

Figure 3

Topic 3: Skills & Technical Capacity Building.

The LDAvis visualization supported the thematic distinctiveness of these topics by showing relatively well-separated topic clusters in two-dimensional space. Adjusting the lambda parameter was particularly useful in distinguishing general-purpose terms (e.g., “cybersecurity”) from terms uniquely tied to specific themes.

Together, these three topics suggest that cybersecurity research – at least in this sample of Web of Science articles – is largely structured around three pillars: legal regulation, skills and capacity development, and strategic policy governance.

The GDPR, effective since 2018, establishes comprehensive guidelines for handling personal data within the EU. While not exclusively focused on smartphones, the GDPR’s provisions are directly applicable to mobile devices and applications that process personal information. Smartphones often collect and store a vast array of personal data, including contacts, photos, location information, and browsing histories. Under the GDPR, organizations that develop or manage mobile applications must ensure that any personal data collected is processed lawfully, transparently, and for a specific purpose. Users must be informed about what data is being collected, the reasons for its collection, and how it will be used. Moreover, explicit consent from users is required before collecting sensitive information, and they should have the ability to withdraw this consent at any time.

The GDPR also emphasizes the principle of data minimization, meaning that apps should only collect data that is necessary for their functionality. For instance, if an app’s primary function doesn’t require access to a user’s location, it shouldn’t request or collect that information. Additionally, organizations are obligated to implement appropriate security measures to protect personal data stored on smartphones from unauthorized access, loss, or disclosure. This includes using encryption, secure authentication methods, and regularly updating security protocols. Furthermore, the GDPR grants individuals rights over their personal data, such as the right to access, rectify, or erase their information. Mobile applications should provide users with straightforward mechanisms to exercise these rights. For example, an app might include settings that allow users to view the data collected about them and request its deletion if desired.

One of the primary objectives of the GDPR is to ensure transparency and accountability in data processing activities. Organizations are required to obtain explicit consent from users before collecting or processing their personal data. Additionally, the regulation mandates organizations to notify authorities and affected individuals in the event of a data breach. By safeguarding citizens’ rights and reducing the risk of data breaches, the GDPR has become a cornerstone of the EU’s cybersecurity strategy. Organizations and developers must ensure that their mobile applications adhere to GDPR principles to protect user privacy and avoid potential penalties.

Figure 4 illustrates the total number of GDPR fines issued over time, showing a steady and almost linear increase. The enforcement activity started slowly in 2018, but by 2019, the number of cases rose at a faster pace. The consistent upward trend indicates that GDPR enforcement has been persistent, with regulatory bodies actively monitoring and penalizing non-compliance. Even in 2024 and early 2025, new fines continue to be imposed, demonstrating that data protection authorities are still actively ensuring compliance. While the financial penalties have seen occasional sharp increases due to high-profile cases, the enforcement activity itself has remained steady. This reinforces the idea that GDPR compliance is an ongoing requirement rather than a one-time concern for organizations handling personal data.

Figure 4

Cumulative number of GDPR fines over time.

Figure 5 shows how GDPR fines are distributed across different sectors, highlighting the industries most impacted by data protection violations. The Media, Telecoms, and Broadcasting sector leads by a significant margin, accounting for the vast majority of penalties. This is particularly relevant for mobile cybersecurity, as telecom providers and digital media companies process massive amounts of personal data, including location tracking, online behaviors, and communications metadata. Mobile cybersecurity is directly tied to GDPR compliance, as smartphones are at the core of how personal data are collected, processed, and shared. Several key observations emerge when we analyze the chart in this context. Telecom providers and digital platforms often handle personal identifiers, call logs, browsing history, and app usage data. A lack of proper encryption, security vulnerabilities, or failure to obtain explicit consent for data tracking can lead to GDPR violations. High-profile cases, such as fines against major social media platforms and messaging services, show the regulatory focus on mobile-based privacy concern.

Figure 5

Sum of GDPR fines by sectors.

Many mobile apps in retail, finance, and e-commerce fail to implement proper user consent mechanisms, leading to excessive data collection. Security lapses in these apps can expose customer payment details, addresses, and personal data to cyberattacks. Unauthorized tracking of user behavior for marketing purposes has resulted in significant fines. Many organizations have been fined for excessive employee monitoring through mobile tracking tools, biometric data collection, or unauthorized access to personal mobile communications. The increased use of bring-your-own-device policies has introduced new risks, where work-related apps on personal smartphones can create security loopholes. This chart reinforces the fact that sectors handling large amounts of personal data on mobile devices are also the most vulnerable to GDPR violations. The growing reliance on smartphones for communication, banking, work, and healthcare means that mobile cybersecurity must be a top priority for compliance. Companies must ensure that mobile apps and services adhere to GDPR principles, including:

Data minimization (collecting only necessary data).

The EU’s Cybersecurity Act, which came into force in 2019, establishes a comprehensive framework for cybersecurity certification across EU member states. This framework is designed to ensure that information and communication technology (ICT) products, services, and processes, including smartphones, meet consistent cybersecurity standards throughout their lifecycle. Under this act, the EU Agency for Cybersecurity (ENISA) is empowered to develop certification schemes that define specific requirements for various ICT products and services. For smartphones, this means manufacturers are encouraged to adhere to these certification schemes to demonstrate that their devices comply with established cybersecurity standards. While the certification is voluntary, it serves as a benchmark for security, promoting trust among consumers and stakeholders.

Building upon the foundation laid by the Cybersecurity Act, the EU introduced the Cyber Resilience Act in 2024. This legislation imposes mandatory cybersecurity requirements on products with digital elements, explicitly including smartphones. Manufacturers are now obligated to ensure that devices are designed and developed with security in mind, addressing potential vulnerabilities from the outset. Additionally, they must provide security updates and inform users about how to maintain the device’s security over its operational lifespan.

In the United States, while there isn’t a singular comprehensive cybersecurity law equivalent to the EU’s framework, various federal regulations impact smartphone security. The Federal Trade Commission Act (FTC Act) prohibits unfair or deceptive trade practices, which the Federal Trade Commission (FTC) interprets to include inadequate data security measures. This interpretation holds smartphone manufacturers and app developers accountable for implementing reasonable security practices to protect consumer data. Furthermore, the National Institute of Standards and Technology has published guidelines, such as SP 800-124, which provide recommendations for securing mobile devices. These guidelines, while not legally binding, serve as valuable resources for organizations aiming to enhance the security of smartphones within their operations.

Both the EU and the United States have established frameworks and guidelines to enhance the cybersecurity of smartphones. The EU’s approach combines voluntary certification with mandatory requirements, ensuring a comprehensive strategy to mitigate risks associated with smartphone usage. In contrast, the United States relies on a combination of regulatory enforcement and advisory guidelines to promote secure practices among manufacturers and users.

Directive 2022/2555, known as the Network and Information Systems Security Directive 2 (NIS2), adopted by the EU in 2022, aims to enhance cybersecurity across critical sectors by establishing comprehensive risk management and incident reporting requirements. The evolution from the NIS Directive to NIS2 brings substantial changes in cybersecurity regulations, particularly in the areas of risk management, incident reporting, harmonization across EU member states, and enforcement mechanisms. These revisions reflect the increasing complexity of cyber threats and the need for a more unified and stringent regulatory framework across the EU. While NIS2 does not explicitly focus on smartphones, its broad definition of “network and information systems” encompasses devices such as smartphones and tablets. Consequently, organizations must consider mobile device security within their compliance strategies. NIS2 mandates that entities implement robust cybersecurity measures, including policies on risk analysis, incident handling, and supply chain security. Given the prevalent use of smartphones in professional settings, securing these devices becomes essential to prevent unauthorized access and data breaches. Implementing mobile threat defense solutions can help organizations detect and mitigate risks associated with mobile devices, thereby aligning with NIS2’s requirements.

Furthermore, NIS2 emphasizes the importance of multi-factor authentication (MFA) to prevent unauthorized access. Applying MFA to smartphone access ensures that only authorized personnel can retrieve sensitive information, thereby enhancing overall security. A significant feature of NIS2 is the establishment of computer security incident response teams to coordinate threat responses and share information. These teams play a crucial role in identifying vulnerabilities and mitigating risks. The directive also promotes cross-border collaboration through the European Cyber Crisis Liaison Organisations Network (EU-CyCLONE), which ensures a coordinated response to large-scale cyber incidents. By fostering cooperation and information sharing, NIS2 enhances the EU’s collective ability to address cybersecurity challenges.

According to Table 1, the scope of cybersecurity regulations has expanded significantly with the transition from the NIS Directive to NIS2. The original NIS Directive primarily focused on essential service operators, such as those in the energy and transport sectors, along with certain digital service providers, including search engines and cloud services. This approach aimed to secure critical infrastructure but left many sectors with less regulatory oversight. With NIS2, the framework has evolved to cover a much broader range of industries. The directive now includes digital infrastructure providers, such as DNS service providers, and extends to public administration and the food sector. This expansion acknowledges the increasing digitalization of essential services and the growing interconnectivity between industries.

Additionally, NIS2 introduces a dual classification system, distinguishing between “essential” and “important” entities based on their size and sectoral relevance. This means that companies operating in regulated sectors must comply with cybersecurity requirements depending on their economic and social importance, not just their industry type. As a result, the directive ensures a more comprehensive level of protection across the economy, addressing vulnerabilities beyond critical infrastructure and reinforcing cybersecurity measures across both private and public entities.

One of the most significant enhancements introduced by NIS2 is the reinforcement of risk management and cybersecurity requirements. While the original NIS Directive mandated that entities implement risk management practices, the updated framework imposes stricter and more comprehensive obligations. A key area of focus in NIS2 is supply chain security, requiring organizations to assess and mitigate risks associated with third-party vendors and service providers. The directive also mandates enhanced incident response planning, encryption standards, and business continuity measures, ensuring that organizations are not only equipped to prevent cyber incidents but also prepared to respond effectively in case of a breach.

Another critical change under NIS2 is the tightening of incident reporting requirements. The original NIS Directive required entities to report cyber incidents to national authorities within a reasonable timeframe, which allowed for flexibility but also led to inconsistencies in reporting practices. NIS2 establishes a more stringent and structured timeline: entities must submit an initial report within 24 h of discovering a significant cybersecurity incident, followed by a detailed follow-up report after 72 h. A final comprehensive report, outlining the full impact of the breach and the remedial actions taken, must be submitted within 1 month. These revised requirements ensure that cyber incidents are addressed swiftly and that regulators receive timely and detailed information to mitigate risks.

Beyond risk management and reporting obligations, NIS2 strengthens harmonization across EU member states by introducing clear and uniform classification criteria for determining which entities fall under its scope. Under the original NIS Directive, national authorities had greater discretion in interpreting and enforcing cybersecurity rules, leading to regulatory fragmentation across different jurisdictions. In contrast, NIS2 establishes standardized guidelines for classifying entities as either “essential” or “important,” ensuring greater consistency in cybersecurity governance. This change reduces legal uncertainty for businesses operating in multiple EU countries and fosters a more cohesive and predictable regulatory environment. To further reinforce compliance, NIS2 significantly enhances enforcement mechanisms and strengthens liability provisions. Under this new framework, management bodies within covered entities are now explicitly accountable for ensuring compliance with cybersecurity obligations. Senior executives and board members may be held personally liable if their organizations fail to meet the directive’s requirements. In addition to increased individual accountability, the financial penalties under NIS2 are considerably more severe than those under the original directive. Essential entities that violate the regulations can face fines of up to €10 million or 2% of their global annual turnover, representing a major escalation in enforcement measures.

While NIS2 does not specifically target smartphones, its comprehensive approach to cybersecurity necessitates that organizations include mobile device security in their risk management frameworks. By implementing appropriate security measures, organizations can ensure compliance with NIS2 and protect their information systems from potential threats.