A UNIFIED DATA PROTECTION AND PRIVACY ARCHITECTURE FOR CYBER-PHYSICAL SYSTEMS: MANAGING CROSS-DOMAIN, SYSTEMIC, AND CASCADING PRIVACY RISKS IN CONVERGED ENVIRONMENTS

Cyber physical ecosystem combines information technology, operational technology and physical security infrastructures, forming multi personal data flow behind the scenes in a complicated environment. Many traditional privacy frameworks, while suitable for digital aspects, are insufficient for interactions across domains, systemic interactions and cascading disruptions that increase privacy exposure in converged systems. In this study, a Unified Data Protection and Privacy Architecture to deal with privacy risks between a cyber physical space is introduced. Built on four mutually dependent layers, or structural capabilities, to deal with data flows across domains, cross domain coordination of privacy incident response, and compliance with regulatory requirements, they are as follows: Privacy Governance, Operational Privacy, Technology and Cryptographic Controls, and Assurance and Compliance. 
The model is aligned with the principles of GDPR, NIS2, DORA, ISO/IEC 27001, ISO/IEC 27701, ISO 31000 and ISO 22301, providing harmonised governance, clear use of the same operational principles across IT, OT and physical entities and interoperable technological controls. 
The sector specific implications of the threats faced by critical infrastructure, financial services, industrial environments and public sector organisations are explored. 
The findings demonstrate that unified privacy architectures enhance organisational resilience, reduce fragmentation, and support coordinated protection of personal data in cyber physical systems. The proposed model provides a structural foundation for privacy resilience and offers a pathway for future research on empirical validation and privacy metrics for converged environments.