Developing 21st century platform business models. A human-centred approach to personal data management

In recent years, digital platforms have become a backbone of modern society, shaping how people communicate, how businesses operate, and how services are delivered. While offering conveniences, platform business models built on extensive collection and use of personal data, raising concerns about data exploitation and individual privacy. These concerns were widely discussed by scholars, amplified by the media, and brought to the forefront by high-profile scandals. In response, the European Union introduced the General Data Protection Regulation (GDPR) regarded as the most comprehensive privacy law in the world aimed to strengthen data protection and empower individuals with greater control over their personal data. The GDPR marks not only a regulatory intervention but a broader normative shift toward a human-centred approach to personal data management, where privacy is treated as a core principle and a basis of trust in the digital environment.

This study advances understanding of legitimation of human-centred approach to personal data management following the implementation of the GDPR, aiming to derive implications for platform business models. Drawing on a qualitative multi-method approach, the study explores transformed perceptions and practices related to data management post GDPR among individuals, organizations and collaborations, examining how these can be taken into account in value creation and value capture in platform business models. The study shows that with legitimation of human-centred approach to personal data management individuals become more conscious participants in value creation, requiring adjustments from the platform operators to sustain value creation and capture over time. It highlights that networks shape perceptions and behaviours on data management among individuals and across organizations. It also indicates that a shared understanding on data management post GDPR is essential for value co-creation in data-sharing collaborations. The findings further highlight redefined legitimacy standards around data management through which platform business models are assessed. As a key contribution the research develops a framework synthesizing the insights on transformed perceptions and practices regarding data management post GDPR providing implications for value creation and value capture of 21st-century platform business models.