2.1. Blockchain-based information security

A blockchain-based information security and privacy system ensures immutability and transparency while enhancing security and privacy through advanced cryptographic methods, such as ZKPs and FHEs, which validate data without revealing sensitive details (Zhou et al., Reference Zhou, Diro, Saini, Kaisar and Hiep2024). Thus, it significantly reduces vulnerabilities and enhances user trust through transparent, verifiable transactions (Liu et al., Reference Liu, Li, Lv, Wang, Zhao and Lu2024). However, regulatory compliance challenges remain. In particular, the immutability of blockchain records creates structural tensions with data subject rights under the GDPR, including rectification and erasure obligations (e.g., EDPB, 2025). Additionally, blockchain’s inherently cross-border and decentralized architecture raises complex issues concerning data sovereignty, jurisdictional oversight, and regulatory enforcement. (Bincoletto, Reference Bincoletto2020).

2.2. Computational literature review

The CLR topic modeling method used to uncover the hidden thematic structure from a large corpus of literature enables the conduction of a more comprehensive and unbiased analysis (Antons et al., Reference Antons, Breidbach, Joshi and Salge2023). CLR uses advanced machine learning (ML) algorithms to systematically analyze large volumes of text. The automated process of CLR accelerates the review process and increases the scope of insights gained from the literature. CLR relies on topic modeling techniques, particularly Latent Dirichlet Allocation (LDA) (Blei et al., Reference Blei, Ng and Jordan2003; Uddin et al., Reference Uddin, Shankar, Mukta, Kumar and Islam2024), to detect underlying thematic patterns across document collections. LDA topic modeling uses an unsupervised probabilistic statistical model to identify hidden topics in a corpus from the content of the articles (Blei et al., Reference Blei, Ng and Jordan2003).

To perform CLR, researchers follow a structured framework involving six key steps:

1. 1. Begin with a conceptual goal that is the researcher’s motivation to perform the review.

2. 2. Operationalizing the CLR helps identify the boundaries for selecting the content and the area of the work.

3. 3. Choose a computational technique regarding the suitability of the corpus of the document.

4. 4. Perform the content analysis by preparing the data based on the selected computational algorithm in the previous steps.

5. 5. Generate original insights by organizing the evaluation of outputs in step four.

6. 6. Present the findings by applying synthesis forms like research agenda, taxonomy, models, meta-analysis, and meta-theory to present the findings and synthesize the insights into useful building blocks for further research.

2.3. Previous literature works

Mohanta et al. (Reference Mohanta, Jena, Panda and Sobhanayak2019) conducted an SLR on 150 articles to analyze blockchain applications, in which 20 articles ware related to security and privacy challenges in blockchain implementation. A study by Zhang et al. (Reference Zhang, Xue and Liu2019) analyzed 14 articles that described consensus algorithms, hash-chained storage, mixing protocols, anonymous signatures, noninteractive ZKPs, and secure MPC to achieve security and privacy in blockchain-based systems. Waheed et al. (Reference Waheed, He, Ikram, Usman, Hashmi and Usman2020) analyzed 43 articles to evaluate security and privacy challenges and vulnerabilities and propose an ML-based automated security and privacy mechanism. Ismagilova et al. (Reference Ismagilova, Hughes, Rana and Dwivedi2022) reviewed 99 articles focusing on the security and privacy of mobile devices in smart cities, power systems, healthcare, and blockchain. Gugueoth et al. (Reference Gugueoth, Safavat, Shetty and Rawat2023) reviewed 31 articles on Internet of Things (IoT), describing attacks on IoT on security and privacy vulnerabilities, and identified countermeasures. An SLR by Kiania et al. (Reference Kiania, Jameii and Rahmani2023) examined 51 articles on blockchain-based healthcare systems to improve security and privacy. A study presented by Qahtan et al. (Reference Qahtan, Yatim, Zulzalil, Osman, Zaidan and Alsattar2023) provides a comprehensive taxonomy of attribute-related security and privacy developments for the blockchain-based healthcare industry 4.0 and identifies challenges in multicriteria evaluation. Myrzashova et al. (Reference Myrzashova, Alsamhi, Shvetsov, Hawbani and Wei2023) present an SLR of 100 articles on the adoption of Federated Learning (FL) in blockchain-based healthcare systems to identify vulnerabilities in security and privacy measures. Akanfe et al. (Reference Akanfe, Lawong and Rao2024) analyze 71 articles to explore uncertainties and misalignments between blockchain and privacy regulations, such as GDPR. The study used the Technology-Organization-Environment (TOE) framework to identify areas of conflict. Wylde et al. (Reference Wylde, Rawindaran, Lawrence, Balasubramanian, Prakash, Jayal, Khan, Hewage and Platts2022) present a comprehensive cybersecurity framework that integrates blockchain, IoT standardization, and machine learning to enhance privacy protection and regulatory compliance, while addressing data security and privacy vulnerabilities. Zafar (Reference Zafar2025) analyzed GDPR governance of joint controllership jurisprudence, highlighting compliance tools such as chameleon hashes, redactable chains, and ZKPs, and stressed the need for a clear GDPR regulatory framework for blockchain. Finck (Reference Finck2018) describes conceptual frictions between decentralization, ledger immutability, and GDPR duties (controller identification; encrypted/hashed data as personal data; and rectification/erasure), urging on techno-legal interoperability. Further, Z Li (Reference Li2020) examined how EU GDPR requirements align with blockchain, suggesting technical standardization to promote compliance with GDPR principles. The author focuses on accountability, the right to erasure, data portability, and data protection by design. Xu et al. (Reference Xu, Sun, Li, Sun, Zhang and Zhang2023) present a Web3 “deController” infrastructure that addresses cyber sovereignty and GDPR compliance, indicating that aligning blockchain identities with the GDPR’s “purpose limitation” can reduce liability gaps. De Filippi and Hassan (Reference De Filippi and Hassan2016) illustrate blockchain and smart contracts as regulatory technologies that shift from “code is law” to “law is code,” highlighting the need for legal flexibility in code-based governance.

The above-discussed studies employ a systematic/comprehensive literature review process on small corpora and offer only quantitative and qualitative assessments (Nightingale, Reference Nightingale2009; Thilakaratne et al., Reference Thilakaratne, Falkner and Atapattu2019). Researchers typically identify trends and process unstructured data using manual or semi-structured techniques. These approaches generally lack automation, scalability, real-time analysis, algorithmic topic evolution tracking, dynamic synthesis, and latent-topic insights, as shown in Table 1. However, Shahid (Reference Shahid2020) performed an LDA on a corpus of 2125 articles to identify topics. The research focused on computer science, followed by economics and business, highlighting the need for further research on blockchain development.

Table 1.

Comparison with existing literature review studies

Table 1. Long description

Starting from the top row, each study is listed in the leftmost column: Mohanta et al. 2019, Zhang et al. 2019, Waheed et al. 2020, Shahid Reference Shahid2020, Myrzashova et al. Reference Myrzashova, Alsamhi, Shvetsov, Hawbani and Wei2023, Qahtan et al. 2023, Gugueoth et al. 2023, Akanfe et al. 2024, and Our study. The first column shows the number of literature items included: 20, 14, 43, 2125, 100, 52, 31, 71, and 3904 respectively. The next twelve columns represent analytic features: quantitative analysis, qualitative analysis, data collection automation, scalability, real-time analysis, algorithmic topic evolution tracking, dynamic literature synthesis, trends and pattern identification, unstructured data processing, data-driven insights, and latent topic insight. For each feature, a check mark indicates presence and a multiplication sign indicates absence. Mohanta et al. has quantitative analysis, qualitative analysis, trends and pattern identification, data-driven insights, and latent topic insight, but lacks other features. Zhang et al. has quantitative analysis, qualitative analysis, trends and pattern identification, data-driven insights, and latent topic insight, but lacks other features. Waheed et al. has quantitative analysis, qualitative analysis, trends and pattern identification, data-driven insights, and latent topic insight, but lacks other features. Shahid has all twelve features present. Myrzashova et al. has quantitative analysis, qualitative analysis, trends and pattern identification, data-driven insights, and latent topic insight, but lacks other features. Qahtan et al. has quantitative analysis, qualitative analysis, trends and pattern identification, data-driven insights, and latent topic insight, but lacks other features. Gugueoth et al. has quantitative analysis, qualitative analysis, trends and pattern identification, data-driven insights, and latent topic insight, but lacks other features. Akanfe et al. has quantitative analysis, qualitative analysis, trends and pattern identification, data-driven insights, and latent topic insight, but lacks other features. Our study has all twelve features present. Numeric values and feature definitions are provided in the table footnote.

Note: Numeric values in the column headings are indicated as follows: 1 = Number of literature included in the analysis, 2 = Quantitative analysis, 3 = Qualitative analysis, 4 = Data collection automation, 5 = Scalability, 6 = Real-time analysis, 7 = Algorithmic topic evolution tracking, 8 = Dynamic literature synthesis, 9 = Trends and pattern identification, 10 = Unstructured data processing, 11 = Data-driven insights, 12 = Latent topic insight.

Further, analysis of previous blockchain-focused literature reveals that most authors acknowledge regulations such as the GDPR, highlighting blockchain and policy challenges, but lack regulatory text or purpose-specific solutions (Akanfe et al. (Reference Akanfe, Lawong and Rao2024), Finck (Reference Finck2018), Ismagilova et al. (Reference Ismagilova, Hughes, Rana and Dwivedi2022), and Zafar (Reference Zafar2025)). Additionally, the literature is confined to technical, social, and governance questions, hindering the development of a unified framework for scholars to integrate findings. Much of the research is domain-specific, limiting broader, cross-disciplinary insights into blockchain’s systemic impact. Moreover, scholars frequently overlook data governance concerns beyond technical security controls, offering limited examination of how decentralized ecosystems redistribute accountability among developers, node operators, end users, and regulatory authorities.

To address these issues, our work adopts LDA-based CLR topic modeling to uncover trends in security and privacy for blockchain systems policies. Our work examines nearly 4000 publications and is the only study to integrate all 12 parameters presented in Table 1. Furthermore, our work positions policy and regulation as the analytical centerpiece for topics related to blockchain-based security and privacy, examining landmark regulations such as the US FIT21 Act and the EU’s MiCA. Unlike previous works that broadly reference GDPR, our study examines specific legal articles and assesses how they can bridge compliance gaps. By balancing regulatory rigor with technological feasibility, we reframe blockchain regulation as a dynamic, multijurisdictional challenge. These findings offer actionable guidance for policymakers and future research directions on interoperability and privacy-enhancing architectures in the IS field.

3.1. Data collection

The data collection process presented in Figure 1 is explained in detail with the following steps:

1. 1. Identification phase: we conducted a comprehensive search across multiple databases, including IEEE, Web of Science, and Scopus by using specific keywords with Boolean logic: (“Blockchain” AND “Security” AND “Privacy” AND “Decentrali*”) OR (“Blockchain” AND “Security” AND “Privacy” AND “Distributed”).

2. 2. Screening phase: search results overlap across databases, with the majority of relevant articles indexed in Scopus. The Scopus database is widely recognized as comprehensive, multidisciplinary, and reliable, as reflected in the robustness of its abstracting and citation indexing standards. Therefore, we continued with the 4975 relevant articles identified in the Scopus search interface and applied our inclusion and exclusion criteria in the subsequent phases.

3. 3. Inclusion criteria:

• • Publications indexed in Scopus.

• • Articles published in peer-reviewed journals and conferences.

• • Language limited to English.

• • Subject areas specifically included: Computer Science, Engineering, Mathematics, Decision Sciences, Energy, Medicine, Business, Management and Accounting, Health Professions, Social Sciences, Environmental Science, Economics, Econometrics, and Finance.

• 4. Exclusion criteria:

• • Articles not published in English.

• • Books, book chapters, reviews, letters, editorials, notes, and other non-peer-reviewed materials.

• • Articles outside the designated subject areas mentioned above.

  Applying these inclusion and exclusion criteria reduced the total number of articles from 4975 to 4016.

• 5. Eligibility phase: We exported metadata for the 4016 retrieved articles into a CSV file and identified duplicate records using DOIs. Duplicates were removed using the pandas library in Python, resulting in a refined dataset of 3904 unique articles for the CLR analysis.

• 6. Included phase: To conduct thematic analysis and accurately identify research topics, we utilized the abstracts of the remaining 3904 articles.

Figure 1.

Data collection process.

Figure 1. Long description

The flowchart begins at the top left with the Identification Phase, a blue box stating search across databases including I E E E, W o S, and Scopus with specific keywords, n equals zero. An arrow points right to the Screening Phase, an orange box, describing selection of Scopus due to comprehensive collection and overlap with other databases, n equals four thousand nine hundred seventy-five. Another arrow leads right to the Inclusion Criteria, a green box, listing indexed in Scopus, peer-reviewed, English language, and domain specific subject areas, n equals four thousand sixteen. From this box, an arrow points downward to the Eligibility Phase, a green box at the bottom left, stating export metadata as C S V and removing duplication by D O I, n equals four thousand sixteen. An arrow leads right to the Included Phase, a green box, stating for thematic analysis the abstracts of the remaining n equals three thousand nine hundred four articles were included.

3.2. Metadata analysis

To illustrate the research landscape, we conducted a bibliometric impact analysis on the cleaned corpus of 3904 Scopus records. We parsed the CSV metadata, including title, authors, source/venue, year, citation counts, and author affiliations. We processed it with the litstudy Python library (https://nlesc.github.io/litstudy/) to compute standard indicators (counts, group-bys, venue tallies, and per-year statistics), following established bibliometric practice (Glänzel and Moed, Reference Glänzel and Moed2002).

We defined four complementary impact views:

• • Citation impact per year: Articles are binned into citation ranges and plotted by publication year. Due to a very small number of publications in earlier years, we started interpretation from the year 2016. This analysis represents the continuous research engagement of scholars in the field of security and privacy through blockchain (Figure 4).

• • Output growth: Counts of annual publications are presented to show the trajectory over time, which highlights the growing number of publications by researchers (Figure 5).

• • Venue concentration: We examined publication sources to identify leading journals and conferences and ranked them based on the number of articles they published in the blockchain domain (Figure 6).

• • Geography and collaboration: Analyze the author affiliations aggregated by countries to plot the top-10 countries by author frequency and construct a country co-authorship network to understand the global view of research and their collaborative effort to tackle security and privacy challenges on blockchain (Figure 7a,b).

We visualized these indicators and provided concise narrations of the patterns (e.g., post-2016 growth, concentration in leading IEEE and LNCS/CCIS venues, and strong cross-country collaborations). In our analytical workflow, we positioned this impact analysis after data collection and cleaning, and before executing content analysis and topic modeling.

3.3. Abstract preprocessing and analysis with LDA

We conducted the content analysis by converting the CSV file into a Pandas DataFrame and extracting abstracts using the Pandas library. As abstracts concisely convey each study’s purpose, methods, and key findings, they help to understand emerging patterns and themes within the dataset while aligning with the methodological rigor suggested by Principe et al. (Reference Principe, de Souza Vale, de Castro, Carvano, Henriques, de and de2022).

Further, preprocessing of the abstract dataframe involved gensim.utils.simple_preprocess from Gensim ( https://pypi.org/project/gensim/) Python library to parse abstracts in four main steps programmatically:

1. 1. Text cleaning: The process of removing unnecessary text and converting all text into lowercase, providing consistency, and removing repetition of words.

2. 2. Removing stop words: Insignificant words such as “the,” “a,” “is,” “and,” and so forth, are removed, emphasizing key terms with higher significance.

3. 3. Tokenization: It involves splitting text into minimal, considerable elements. It also applies bigrams and trigrams to groups of frequent words, treating them as single units, improving the semantic analysis of specific sentences in the LDA model.

4. 4. Lemmatization: Through this process, a word is derived to its root form while preserving the context. For example, “organizational” will become “organization.”

After preprocessing, we applied LDA from Gensim on the dataset and built a corpus dictionary using gensim.corpora.Dictionary, which converts the dataset into a TF–IDF-weighted bag-of-words corpus, then trains the LDA model with 40 topics. We evaluated model performance using the UMass coherence metric and obtained a coherence score of $ 0.46 $ through gensim.models.CoherenceModel. The result ware interpreted through manual verification, with human-readable labels and word clouds generated for the top-weighted terms (Figure 10). This process ensured that the corpus was processed efficiently, while the substantive meaning of each topic remained clear and reliable.

Furthermore, to provide a deeper understanding of the LDA process, we illustrate it using the probabilistic graphical model shown in Figure 2 (Momtazi, Reference Momtazi2018). In this model, we represent each document as a mixture of $ T $ latent topics, where each topic is a probability distribution over the vocabulary. The outer plate ( $ M $ ) denotes the full collection of documents, while the inner plate ( $ {N}_d $ ) captures the repeated generation of words within each document.

Figure 2.

The graphical model representation of unsupervised LDA.

Figure 2. Long description

The outermost rectangle labeled M contains a horizontal sequence of nodes: alpha points right to theta, which points right to z. z points right to w, which is shaded pink. w is inside a smaller rectangle labeled N sub d, nested within M. Above, beta points right to phi, which is inside a green rectangle labeled T. An arrow from phi points downward to w. All arrows indicate conditional dependencies. The model structure visually encodes the generative process of Latent Dirichlet Allocation, with each variable and plate representing parameters, latent variables, observed words, and document or topic groupings.

The generative process proceeds as follows:

1. 1. $ \beta $ serves as the Dirichlet prior for the per-topic word distributions. For each topic $ t\in T $ , we draw a multinomial distribution over words, $ {\phi}_t $ , from $ Dir\left(\beta \right) $ . The $ T $ plate in the figure represents this process, which we repeat for all topics.

2. 2. $ \alpha $ functions as the Dirichlet prior for the per-document topic distributions. For each document $ d\in M $ , we draw a multinomial distribution over topics, $ {\theta}_d $ , from $ Dir\left(\alpha \right) $ .

3. 3. For each word position $ n\in {N}_d $ in document $ d $ , a topic $ {z}_{dn} $ is sampled from $ Multinomial\left({\theta}_d\right) $ and a word $ {w}_{dn} $ is then drawn from $ Multinomial\left({\phi}_{z_{dn}}\right) $ .

In our implementation, after preprocessing and tokenization (including bigram and trigram construction to preserve phrases such as “access-control”), we construct the Document-Term Matrix (DTM) as:

$ {DTM}_{ij}=f\left({t}_j,{d}_i\right) $

where $ f\left({t}_j,{d}_i\right) $ is the frequency of term $ {t}_j $ in document $ {d}_i $ . LDA then estimates $ \theta $ (topic distributions per document) and $ \phi $ (word distributions per topic) iteratively.

Since LDA is unsupervised, the optimal number of topics $ T $ is determined using the coherence score $ C $ :

$ C=\sum \limits_{m=2}^M\sum \limits_{l=1}^{m-1}\log \frac{P\left({w}_m,{w}_l\right)+\unicode{x025B}}{P\left({w}_l\right)} $

where, $ {w}_m,{w}_l $ = top words in a topic, $ P\left({w}_m,{w}_l\right) $ = probability of co-occurrence of words $ {w}_m $ and $ {w}_l $ within a sliding window in the corpus, and $ \unicode{x025B} $ = small constant to avoid division by zero.

Higher coherence scores indicate more interpretable and semantically coherent topics. We selected the value of $ T $ that produced the most meaningful themes, and then examined the content within each topic to assess blockchain’s role in security and privacy, which further aligned with challenges related to policy and regulatory.

Figure 3 shows the systematic method followed in our work to explore blockchain Information security and privacy research. The process starts with selecting Scopus for data collection, followed by exporting and preparing the dataset. Impact analysis was conducted to evaluate key publications and authors. Next, we preprocess the abstracts for topic modeling using LDA. Through LDA, we identify the major research themes. Then, the deployment of computational techniques refines the focus and ensures coherence in topics. Furthermore, the content analysis phase includes interpreting output validity checks, manually reviewing significant articles, and identifying key insights. The process concludes with synthesizing findings into a techno-legal context and outlining future research directions.

Figure 3.

Research framework.

Figure 3. Long description

At the top left, green boxes begin with Explicating slash Relating, listing summarizing previous findings and finding connections in research gap. Below, the first main step is Define Research scope. Moving right, a blue box defines domain for CLR and preparation of dataset, detailing database selection, export data, data collection process, and impact analysis through metadata. The next main step is Operationalize the CLR. Further right, a blue box covers dataset preprocessing and technique selection, including preprocess of dataset and topic modelling through L D A technique, leading to Computational technique selection. The next step is Perform content analysis, with a blue box below listing analysis, data cleaning process, CLR tools deployment, and topic number selection. The next step is Organise and evaluate outputs, with a blue box below for result discussion, including interpretation of output, manual checking of significant articles, and identifying insights. The next step is Generate original Insights, followed by Presentation of Findings. At the bottom, a blue box under Presentation of Findings lists synthesis of insights and techno dash legal discussion, and future studies. Two colored annotation bands run above and below the main flow: Dataset and CLR model Creation (orange, top right) spans the first five steps, and CLR Deployment and Interpretation (orange, bottom left) spans the last four steps.

6.1. Technical design in regulatory and policy compliance

Our analysis shows that system architects can operationalize the GDPR’s Article 25 privacy-by-design principle through deliberate architectural choices (e.g., Finck, Reference Finck2018; Zafar, Reference Zafar2025). Integrating FL and MPC with blockchain can reduce centralized access to personal data, supporting data minimization and purpose limitation under Article 5(1)(b) (De Filippi and Hassan, Reference De Filippi and Hassan2016), while also reducing cross-border transfer exposure and facilitating accountability under Article 5(2) (Zafar, Reference Zafar2025). When personal data is kept off-chain, blockchain infrastructures mitigate tensions related to immutability and the right to erasure (Article 17). Furthermore, ZKPs can address selective disclosure and pseudonymization safeguards consistent with Recital 28 (Introduction of Pseudonymisation at https://gdpr-info.eu/recitals/no-28/). MPC enables collaborative analytics without revealing raw data and can structure processing arrangements in environments that may qualify as joint controllership under Article 26. Together, these technologies demonstrate the study’s central finding that technical design choices play a critical role in regulatory compliance (Finck, Reference Finck2018; Zafar, Reference Zafar2025).

6.2. Adapting to different regulatory and economic contexts

Although this study focuses on the GDPR and FIT21, many jurisdictions operate comparable data protection or sector-specific privacy frameworks, including LGPD in Brazil (European Commission, 2019), PDPA-type laws across Asia (Wong YongQuan, Reference Wong YongQuan2017), and the CCPA/CPRA and HIPAA in the United States (Determann and Tam, Reference Determann and Tam2020; Mulgund et al., Reference Mulgund, Mulgund, Sharman and Singh2021). The technical patterns identified here can be adapted to diverse regulatory contexts. In strict data-protection economies, FL can reduce exposure to cross-border data transfers, while ZKP and MPC can support sensitive-data governance. In sector-specific economics such as healthcare, finance, and energy, tailored architectures may enable privacy-preserving analytics and collaborative oversight. Emerging or resource-constrained economies, incremental deployment using lightweight FL, simplified ZKPs, and outsourced MPC can facilitate privacy-aware design (Lim and Oh, Reference Lim and Oh2025). Open-source tools and international guidance may further lower adoption barriers.

6.3. Practical relevance for policymakers and researchers

The findings highlight the need for simplified, technology-aware regulatory guidance. Blockchain systems combined with privacy-preserving FL, ZKP, and MPC can support regulatory objectives while enabling innovation. For policymakers, this suggests prioritizing guidance, certification, coordination, and regulatory sandboxes over technology-specific rules. Scenario-based guidance and interoperability standards can help clarify how privacy-preserving architectures support compliance (Martin and Kung, Reference Martin and Kung2018; Ulnicane, Reference Ulnicane, Hoerber, Weber and Cabras2022; Raudla et al., Reference Raudla, Juuse, Kuokstis, Cepilovs and Douglas2024). For researchers, system design should begin with legal requirements, such as controller roles, data sensitivity, and user rights, before selecting appropriate combinations of blockchain, FL, ZKP, and MPC. Where feasible, personal data should remain off-chain, with blockchain used primarily for proofs and logs, and design decisions documented to support DPIAs (Data Protection Impact Assessment at https://gdpr.eu/data-protection-impact-assessment-template/) or similar compliance tools (Bu et al., Reference Bu, Wang, Jiang and Liang2020; Ali et al., Reference Ali, Suchismita, Ali and Choi2025).

Overall, blockchain-based systems are not inherently incompatible with data-protection regulations. When aligned with advanced cryptographic and distributed learning techniques, they can contribute to more coherent and adaptive governance in data privacy and information security.