{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,17]],"date-time":"2026-08-17T18:26:51Z","timestamp":1786991211040,"version":"build-2736575974"},"reference-count":58,"publisher":"Public Library of Science (PLoS)","issue":"8","license":[{"start":{"date-parts":[[2026,8,17]],"date-time":"2026-08-17T00:00:00Z","timestamp":1786924800000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Hulunbuir University Doctoral Fund","award":["2024BSJJ10"],"award-info":[{"award-number":["2024BSJJ10"]}]}],"content-domain":{"domain":["www.plosone.org"],"crossmark-restriction":false},"short-container-title":["PLoS One"],"abstract":"<jats:p>As\u00a0China\u2019s\u00a0digital regulatory framework continues to evolve, understanding what drives software developers\u2019 data compliance behavior becomes increasingly important. Drawing on deterrence theory from a behavioral, law-in-action perspective, this study examines how data legal awareness influences data compliance behavior through perceived sanction certainty and perceived sanction severity, and how perceived compliance culture moderates these mediating pathways. Survey data collected from software developers were\u00a0analyzed\u00a0using structural equation modelling. The results indicate that data legal awareness promotes data compliance behavior directly and indirectly through perceived sanction certainty and perceived sanction severity, with certainty exerting a stronger mediating effect than severity. Perceived compliance culture significantly strengthens the effect of data legal awareness on perceived sanction certainty, while its moderating effect on perceived sanction severity receives only limited support. Theoretically, these findings extend deterrence theory to the data compliance domain by specifying the cognition\u2013perception\u2013behavior pathway and identifying the moderating role of compliance culture. Practically, the findings offer implications for how regulatory authorities allocate enforcement resources and how\u00a0organizations\u00a0design compliance management systems.<\/jats:p>","DOI":"10.1371\/journal.pone.0356356","type":"journal-article","created":{"date-parts":[[2026,8,17]],"date-time":"2026-08-17T17:32:43Z","timestamp":1786987963000},"page":"e0356356","update-policy":"https:\/\/doi.org\/10.1371\/journal.pone.corrections_policy","source":"Crossref","is-referenced-by-count":0,"title":["How legal awareness shapes developers\u2019 data compliance behavior: A deterrence theory perspective"],"prefix":"10.1371","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4129-2068","authenticated-orcid":true,"given":"Xinyuan","family":"Wang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3435-796X","authenticated-orcid":true,"given":"Zhenyang","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"340","published-online":{"date-parts":[[2026,8,17]]},"reference":[{"issue":"1","key":"pone.0356356.ref001","doi-asserted-by":"crossref","first-page":"25377","DOI":"10.1038\/s41598-024-77189-w","article-title":"The impact of data factor-driven industry on the green total factor productivity: evidence from the China","volume":"14","author":"P Huang","year":"2024","journal-title":"Sci Rep"},{"issue":"1","key":"pone.0356356.ref002","article-title":"Navigating privacy: a global comparative analysis of data protection laws","volume":"2025","author":"S Lim","year":"2025","journal-title":"IET Informn Secur"},{"key":"pone.0356356.ref003","doi-asserted-by":"crossref","first-page":"528","DOI":"10.51594\/csitrj.v5i3.859","article-title":"Data privacy laws and compliance: a comparative review of the EU GDPR and USA regulations","volume":"5","author":"SS Bakare","year":"2024","journal-title":"Comput Sci IT Res J"},{"issue":"1","key":"pone.0356356.ref004","article-title":"China\u2019s emerging data protection framework","volume":"8","author":"R Creemers","year":"2022","journal-title":"J Cybersecur"},{"key":"pone.0356356.ref005","article-title":"Excessive data collection and (mis)use of data: a comparative law and economics study on the Chinese Didi Case and the German Facebook Case","volume":"13","author":"Q Li","year":"2025","journal-title":"Chin J Comparative Law"},{"key":"pone.0356356.ref006","doi-asserted-by":"crossref","first-page":"105994","DOI":"10.1016\/j.clsr.2024.105994","article-title":"From brussels effect to gravity assists: understanding the evolution of the GDPR-inspired personal information protection law in China","volume":"54","author":"W Li","year":"2024","journal-title":"Comput Law Secur Rev"},{"issue":"3","key":"pone.0356356.ref007","doi-asserted-by":"crossref","first-page":"122","DOI":"10.1080\/01972243.2019.1583296","article-title":"Engineering privacy by design: are engineers ready to live up to the challenge?","volume":"35","author":"K Bednar","year":"2019","journal-title":"Inform Soc"},{"key":"pone.0356356.ref008","doi-asserted-by":"crossref","first-page":"106868","DOI":"10.1016\/j.infsof.2022.106868","article-title":"Towards privacy compliance: a design science study in a small organization","volume":"146","author":"ZS Li","year":"2022","journal-title":"Inform Softw Technol"},{"key":"pone.0356356.ref009","doi-asserted-by":"crossref","first-page":"1215","DOI":"10.1109\/SP61157.2025.00146","article-title":"Sorry for bugging you so much. Exploring developers\u2019 behavior towards privacy-compliant implementation.","volume-title":"2025 IEEE Symposium on Security and Privacy (SP)","author":"SA Horstmann","year":"2025"},{"key":"pone.0356356.ref010","first-page":"211","article-title":"Why developers cannot embed privacy into software systems? An empirical investigation.","volume-title":"Proceedings of the 22nd International Conference on Evaluation and Assessment in Software Engineering","author":"A Senarath","year":"2018"},{"issue":"1","key":"pone.0356356.ref011","doi-asserted-by":"crossref","first-page":"79","DOI":"10.1287\/isre.1070.0160","article-title":"User awareness of security countermeasures and its impact on information systems misuse: a deterrence approach","volume":"20","author":"J D\u2019Arcy","year":"2009","journal-title":"Inform Syst Res"},{"issue":"6","key":"pone.0356356.ref012","doi-asserted-by":"crossref","first-page":"1265","DOI":"10.1007\/s10796-019-09956-4","article-title":"A meta-analysis of deterrence theory in information security policy compliance research","volume":"21","author":"S Trang","year":"2019","journal-title":"Inf Syst Front"},{"key":"pone.0356356.ref013","doi-asserted-by":"crossref","first-page":"136558","DOI":"10.1016\/j.scitotenv.2020.136558","article-title":"How does new environmental law affect public environmental protection activities in China? Evidence from structural equation model analysis on legal cognition","volume":"714","author":"J Chen","year":"2020","journal-title":"Sci Total Environ"},{"key":"pone.0356356.ref014","article-title":"Hospital staff\u2019s adherence to information security policy: a quest for the antecedents of deterrence variables","volume":"58","author":"K-M Kuo","year":"2021","journal-title":"Inquiry"},{"key":"pone.0356356.ref015","doi-asserted-by":"crossref","first-page":"111427","DOI":"10.1016\/j.jss.2022.111427","article-title":"Impact of individualism and collectivism cultural profiles on the behaviour of software developers: a study of stack overflow","volume":"192","author":"E Zolduoarrati","year":"2022","journal-title":"J Syst Softw"},{"key":"pone.0356356.ref016","doi-asserted-by":"crossref","first-page":"578","DOI":"10.1504\/IJESDF.2023.133960","article-title":"Legal awareness and its significance when determining the nature of a person\u2019s legal behaviour","volume":"15","author":"E Abdrasulov","year":"2023","journal-title":"IJESDF"},{"key":"pone.0356356.ref017","first-page":"467","volume-title":"Do people know the law? Empirical evidence about legal knowledge and its implications for compliance","author":"B Van Rooij","year":"2021"},{"key":"pone.0356356.ref018","doi-asserted-by":"crossref","first-page":"33","DOI":"10.1111\/lasr.12455","article-title":"Legal consciousness and cultural capital","volume":"54","author":"KM Young","year":"2020","journal-title":"Law Soc Rev"},{"issue":"1","key":"pone.0356356.ref019","doi-asserted-by":"crossref","first-page":"9","DOI":"10.5093\/apj2021a2","article-title":"Legal consciousness: a systematic review of its conceptualization and measurement methods1","volume":"31","author":"F Hor\u00e1k","year":"2021","journal-title":"Anuario de Psicolog\u00eda Jur\u00eddica"},{"key":"pone.0356356.ref020","first-page":"2130","article-title":"Survey of data privacy security based on general data protection regulation","volume":"59","author":"J Zhao","year":"2022","journal-title":"J Comput Res Dev"},{"issue":"6","key":"pone.0356356.ref021","doi-asserted-by":"crossref","first-page":"859","DOI":"10.1177\/0964663919869739","article-title":"After hegemony: the varieties of legal consciousness research","volume":"28","author":"S Halliday","year":"2019","journal-title":"Soc Legal Stud"},{"key":"pone.0356356.ref022","doi-asserted-by":"crossref","first-page":"1055","DOI":"10.3389\/fpsyg.2019.01055","article-title":"Exploring the mode of entrepreneurship education based on the legal-business compound competency in China","volume":"10","author":"T Wang","year":"2019","journal-title":"Front Psychol"},{"issue":"8","key":"pone.0356356.ref023","doi-asserted-by":"crossref","first-page":"380","DOI":"10.3390\/systems11080380","article-title":"Secure data management life cycle for government big-data ecosystem: design and development perspective","volume":"11","author":"R Zahid","year":"2023","journal-title":"Systems"},{"key":"pone.0356356.ref024","first-page":"46","article-title":"Data compliance supervision obligation of network platform and its criminal imputation approach","author":"J Liang","year":"2024","journal-title":"J Zhejiang Univ (Human Soc Sci)"},{"issue":"3","key":"pone.0356356.ref025","doi-asserted-by":"crossref","first-page":"523","DOI":"10.2307\/25750690","article-title":"Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness1","volume":"34","author":"B Bulgurcu","year":"2010","journal-title":"MIS Q"},{"issue":"1","key":"pone.0356356.ref026","doi-asserted-by":"crossref","first-page":"83","DOI":"10.1016\/j.cose.2011.10.007","article-title":"Understanding information systems security policy compliance: An integration of the theory of planned behavior and the protection motivation theory","volume":"31","author":"P Ifinedo","year":"2012","journal-title":"Comput Secur"},{"issue":"2","key":"pone.0356356.ref027","doi-asserted-by":"crossref","first-page":"106","DOI":"10.1057\/ejis.2009.6","article-title":"Protection motivation and deterrence: a framework for security policy compliance in organisations","volume":"18","author":"T Herath","year":"2009","journal-title":"Eur J Inform Syst"},{"key":"pone.0356356.ref028","first-page":"151","article-title":"The effect of sanction on information security policy compliance: an integrated framework based on DT and RCT","volume":"18","author":"R Lin","year":"2015","journal-title":"Nankai Bus Rev"},{"key":"pone.0356356.ref029","first-page":"155","article-title":"Deterrence theory and its application and outlook in the field of information systems research","volume":"44","author":"D Wu","year":"2024","journal-title":"J Modern Inform"},{"key":"pone.0356356.ref030","doi-asserted-by":"crossref","first-page":"205","DOI":"10.1146\/annurev-criminol-030920-112932","article-title":"Sanctions, perceptions, and crime","volume":"5","author":"R Apel","year":"2022","journal-title":"Annu Rev Criminol"},{"key":"pone.0356356.ref031","doi-asserted-by":"crossref","first-page":"194","DOI":"10.1016\/j.trf.2021.02.006","article-title":"Does awareness of penalties influence deterrence mechanisms? A study of young drivers\u2019 awareness and perceptions of the punishment applying to illegal phone use while driving","volume":"78","author":"V Truelove","year":"2021","journal-title":"Transp Res Part F: Traffic Psychol Behav"},{"key":"pone.0356356.ref032","first-page":"18","article-title":"Contemporary Theory of Risk Perception Research: Schools, Trends and Controversies","volume":"26","author":"F Wang","year":"2013","journal-title":"J Beijing Univ Aeronaut Astronautics (Soc Sci Ed, in Chinese)"},{"key":"pone.0356356.ref033","doi-asserted-by":"crossref","first-page":"75","DOI":"10.1007\/s11292-016-9254-2","article-title":"Consequences of legal risk communication for sanction perception updating and white-collar criminality","volume":"12","author":"JT Pickett","year":"2016","journal-title":"J Exp Criminol"},{"issue":"3","key":"pone.0356356.ref034","doi-asserted-by":"crossref","first-page":"157","DOI":"10.2753\/MIS0742-1222290305","article-title":"Organizations\u2019 information security policy compliance: stick or carrot approach?","volume":"29","author":"Y Chen","year":"2012","journal-title":"J Manage Inform Syst"},{"issue":"1","key":"pone.0356356.ref035","doi-asserted-by":"crossref","first-page":"199","DOI":"10.1086\/670398","article-title":"Deterrence in the twenty-first century","volume":"42","author":"DS Nagin","year":"2013","journal-title":"Crime Justice"},{"issue":"4","key":"pone.0356356.ref036","doi-asserted-by":"crossref","first-page":"493","DOI":"10.1177\/0022427819888249","article-title":"Perceived control, severity, certainty, and emotional fear: testing an expanded model of deterrence","volume":"57","author":"SP Roche","year":"2019","journal-title":"J Res Crime Delinquency"},{"issue":"3","key":"pone.0356356.ref037","doi-asserted-by":"crossref","first-page":"103318","DOI":"10.1016\/j.im.2020.103318","article-title":"The role of deterrability for the effect of multi-level sanctions on information security policy compliance: results of a multigroup analysis","volume":"58","author":"L Jaeger","year":"2021","journal-title":"Inform Manage"},{"issue":"5","key":"pone.0356356.ref038","doi-asserted-by":"crossref","first-page":"474","DOI":"10.1108\/IMCS-08-2013-0057","article-title":"Security culture and the employment relationship as drivers of employees\u2019 security compliance","volume":"22","author":"J D\u2019Arcy","year":"2014","journal-title":"Inform Manage Comput Secur"},{"issue":"4","key":"pone.0356356.ref039","doi-asserted-by":"crossref","first-page":"615","DOI":"10.1111\/j.1540-5915.2012.00361.x","article-title":"Managing employee compliance with information security policies: the critical role of top management and organizational culture*","volume":"43","author":"Q Hu","year":"2012","journal-title":"Decision Sci"},{"issue":"2","key":"pone.0356356.ref040","doi-asserted-by":"crossref","first-page":"235","DOI":"10.5172\/jmo.16.2.235","article-title":"Compliance culture: a conceptual framework","volume":"16","author":"L Interligi","year":"2010","journal-title":"J Manage Organ"},{"issue":"1","key":"pone.0356356.ref041","doi-asserted-by":"crossref","first-page":"428","DOI":"10.1111\/1911-3846.12727","article-title":"Corporate integrity culture and compliance: a study of the pharmaceutical industry*","volume":"39","author":"JLM Altamuro","year":"2021","journal-title":"Contemp Accting Res"},{"issue":"2","key":"pone.0356356.ref042","doi-asserted-by":"crossref","first-page":"243","DOI":"10.1016\/j.clsr.2015.01.005","article-title":"Information security culture and information protection culture: a validated assessment instrument","volume":"31","author":"A Da Veiga","year":"2015","journal-title":"Comput Law Secur Rev"},{"key":"pone.0356356.ref043","doi-asserted-by":"crossref","first-page":"103938","DOI":"10.1016\/j.cose.2024.103938","article-title":"Assessing information security culture: a mixed-methods approach to navigating challenges in international corporate IT departments","volume":"144","author":"A Zanke","year":"2024","journal-title":"Comput Secur"},{"issue":"3","key":"pone.0356356.ref044","doi-asserted-by":"crossref","first-page":"313","DOI":"10.1108\/IJOA-Mar-2012-0574","article-title":"Perceived organizational support as a moderator in the relationship between organisational stressors and organizational citizenship behaviors","volume":"21","author":"AK Jain","year":"2013","journal-title":"Int J Organ Anal"},{"issue":"3","key":"pone.0356356.ref045","first-page":"261","article-title":"The roles of awareness, sanctions, and ethics in software compliance","volume":"56","author":"R Moquin","year":"2016","journal-title":"J Comput Inform Syst"},{"issue":"2","key":"pone.0356356.ref046","doi-asserted-by":"crossref","first-page":"238","DOI":"10.1017\/glj.2021.5","article-title":"Theory of social proof and legal compliance: a socio-cognitive explanation for regulatory (non) compliance","volume":"22","author":"S Roy","year":"2021","journal-title":"German Law J"},{"key":"pone.0356356.ref047","doi-asserted-by":"crossref","first-page":"421","DOI":"10.1108\/ICS-11-2016-0089","article-title":"Deterrence and punishment experience impacts on ISP compliance attitudes","volume":"25","author":"S Aurigemma","year":"2017","journal-title":"ICS"},{"issue":"8","key":"pone.0356356.ref048","doi-asserted-by":"crossref","first-page":"1049","DOI":"10.1016\/j.im.2018.05.011","article-title":"Sanction severity and employees\u2019 information security policy compliance: Investigating mediating, moderating, and control variables","volume":"55","author":"X Chen","year":"2018","journal-title":"Inform Manage"},{"issue":"3","key":"pone.0356356.ref049","doi-asserted-by":"crossref","first-page":"879","DOI":"10.3758\/BRM.40.3.879","article-title":"Asymptotic and resampling strategies for assessing and comparing indirect effects in multiple mediator models","volume":"40","author":"KJ Preacher","year":"2008","journal-title":"Behav Res Methods"},{"issue":"5","key":"pone.0356356.ref050","doi-asserted-by":"crossref","first-page":"879","DOI":"10.1037\/0021-9010.88.5.879","article-title":"Common method biases in behavioral research: a critical review of the literature and recommended remedies","volume":"88","author":"PM Podsakoff","year":"2003","journal-title":"J Appl Psychol"},{"key":"pone.0356356.ref051","doi-asserted-by":"crossref","first-page":"539","DOI":"10.1146\/annurev-psych-120710-100452","article-title":"Sources of method bias in social science research and recommendations on how to control it","volume":"63","author":"PM Podsakoff","year":"2012","journal-title":"Annu Rev Psychol"},{"issue":"2","key":"pone.0356356.ref052","doi-asserted-by":"crossref","first-page":"233","DOI":"10.1207\/S15328007SEM0902_5","article-title":"Evaluating goodness-of-fit indexes for testing measurement invariance","volume":"9","author":"GW Cheung","year":"2002","journal-title":"Struct Equation Model: Multidiscip J."},{"issue":"3","key":"pone.0356356.ref053","doi-asserted-by":"crossref","first-page":"464","DOI":"10.1080\/10705510701301834","article-title":"Sensitivity of goodness of fit indexes to lack of measurement invariance","volume":"14","author":"FF Chen","year":"2007","journal-title":"Struct Equation Model: Multidiscip J"},{"issue":"4","key":"pone.0356356.ref054","doi-asserted-by":"crossref","first-page":"865","DOI":"10.1111\/j.1745-9125.2001.tb00943.x","article-title":"Integrating celerity, impulsivity, and extralegal sanction threats into a model of general deterrence: theory and evidence*","volume":"39","author":"DS Nagin","year":"2001","journal-title":"Criminology"},{"issue":"5","key":"pone.0356356.ref055","doi-asserted-by":"crossref","first-page":"1604","DOI":"10.1177\/00111287231170110","article-title":"Certainty, but how certain? severity, but how severe? A quasi-experimental study on digital piracy deterrence in a Spanish citizens sample","volume":"71","author":"AB G\u00f3mez-Bellv\u00eds","year":"2023","journal-title":"Crime Delinquency"},{"key":"pone.0356356.ref056","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2652524.2652544","article-title":"Impact of developer reputation on code review outcomes in OSS projects: An empirical investigation","volume-title":"Proceedings of the 8th ACM\/IEEE International Symposium on Empirical Software Engineering and Measurement","author":"A Bosu","year":"2014"},{"key":"pone.0356356.ref057","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3721127","article-title":"Accountability in code review: the role of intrinsic drivers and the impact of LLMs","volume":"34","author":"A Alami","year":"2025","journal-title":"ACM Trans Softw Eng Methodol"},{"key":"pone.0356356.ref058","volume-title":"Model selection and multi-model inference: a practical information-theoretic approach","author":"KP Burnham","year":"2002","edition":"2"}],"container-title":["PLOS One"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0356356","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,17]],"date-time":"2026-08-17T17:32:51Z","timestamp":1786987971000},"score":1,"resource":{"primary":{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0356356"}},"subtitle":[],"editor":[{"given":"Mohammad Salah","family":"Hassan","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"editor"}]}],"short-title":[],"issued":{"date-parts":[[2026,8,17]]},"references-count":58,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2026,8,17]]}},"URL":"https:\/\/doi.org\/10.1371\/journal.pone.0356356","relation":{},"ISSN":["1932-6203"],"issn-type":[{"value":"1932-6203","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,17]]}}}