In this thesis, we have studied the phenomena of value co-creation in IoT ecosystem, while considering the potential impacts of GDPR on IT value co-creation in the IoT ecosystem. IT firms’ ability to create value is an important aspect of their existence and growth in which case they pursuit different and several means to accomplish this task. IT firms that operate within the IoT ecosystem are categorised as Enablers, Engagers, and Enhancers who interact, work together to provide the technology and services needed to both market the IoT and to deploy it for their own business operations. These actors usually deem it necessary to create value through a co-creation process with customers in order to create well needed, tailored and up-to-date IoT solutions. In such case, customers’ data play a significant role in the development process. Through computer analysis, these data can reveal insightful information that can lead to the creation of relevant and appropriate IT solutions. However, the EU new and upcoming General Data Protection Regulation stand to have some impacts on this creative process, by regulating data practices in technological activities, thereby, creating several concerns among the IT community.