# Data Privacy in the Internet of Things: A Perspective of Personal Data Store-Based Approaches
## 5 Conclusions  
The IoT has been promoting evolution in different areas for years, from agriculture and health to homes and cities. However, its interconnection and data collection introduce new data privacy challenges. This paper reviews these challenges and highlights the necessity of balancing the services provided by IoT and users' privacy. We categorize the IoT privacy threats and discuss the necessity of adopting multifaceted approaches to address data privacy, encompassing users' privacy awareness, data processing regulations, and privacy-enhancing technologies.  
As a central point, we discuss the role of Personal Data Stores as a promising solution to the IoT's privacy challenges. PDSs are moving toward a decentralized approach to mitigating risks associated with data centralization. They promote a user-centric model, enabling users to regain control over data and consequently allowing them to manage their data and decide who has access to them and under what conditions. We present some studies that propose the adoption of PDSs as a privacy-based solution.  
PDSs could be essential in addressing privacy issues, mainly due to their user-centric characteristics. The successful implementation of PDSs within IoT ecosystems will continue to require collaboration between policymakers, technology developers, and users. In addition, we will also need to develop suitable technologies for IoT contexts so that PDSs can be exploited appropriately and privacy protection can be maintained sustainably. Thus, combining privacy awareness and data processing regulation with technology can help deliver a safer user-centric approach that protects privacy without renouncing functionality. In this way, it is also necessary to research methods to raise user awareness and studies on technological adaptations to comply with legal bases or even the development of legal regulations designed explicitly for decentralized environments like PDS.  
In this manner, further efforts should guide future works in some directions: (i) the definition of the roles and responsibilities of users, platform providers, and application developers, particularly regarding the designation of data controllers and processors; (ii) the development of mechanisms to ensure compliance with lawful bases for data processing; (iii) the development of tools that promote user data control, transparency, and truly informed consent; (iv) the design of interfaces and educational strategies, such as gamification, that improve users' comprehension of how their data are processed, the implications of their consent, and the risk associated with data sharing; and (v) the development of ontologies and data schemas to facilitate semantic data sharing across heterogeneous IoT domains.  
Conceptualization, G.P.P. and C.P.; methodology, G.P.P. and C.P.; investigation, G.P.P. and C.P.; writing--original draft preparation, G.P.P. and C.P.; writing--review and editing, G.P.P. and C.P. All authors have read and agreed to the published version of the manuscript.  
This study was partly supported by FAPESB INCITE PIE0002/2022 grant. The authors also thank the CNPq, CAPES, and FAPESB organizations for supporting the Graduate Program in Computer Science at the Federal University of Bahia. Additionally, the authors acknowledge the financial support provided by the Pro-Reitoria de Pesquisa e Pos-Graduacao (PRPPG) of the Federal University of Bahia through the \"Programa de Apoio a Publicaco s Cientificas--Edital 02/2025\", which covered the article processing charges for this publication.  
The authors declare no conflict of interest.