A Data Scope Management Service to Support Privacy by Design and GDPR Compliance

Abstract

In order to empower user data protection and user rights, the European General Data Protection Regulation (GDPR) has been enforced. On the positive side, the user is obtaining advantages from GDPR. However, organisations are facing many difficulties in interpreting GDPR, and to properly applying it, and, in the meanwhile, due to their lack of compliance, many organisations are receiving huge fines from authorities. An important challenge is compliance with the Privacy by Design and by default (PbD) principles, which require that data protection is integrated into processing activities and business practices from the design stage. Recently, the European Data Protection Board (EDPB) released an official document with PbD guidelines, and there are various efforts to provide approaches to support these. However, organizations are still facing difficulties in identifying a flow for executing, in a coherent, linear and effective way, these activities, and a complete toolkit for supporting this. In this paper, we propose the design of such flow, and our comprehensive supporting toolkit, as part of the DEFeND EU Project platform. Within DEFeND, we identified candidate tools, fulfilling specific GDPR aspects, and integrated them in a comprehensive toolkit: the DEFeND Data Scope Management service (DSM). The aim of DSM is to support organizations for continuous GDPR compliance through model-based Privacy by Design analysis. Here, we present DSM, its design, flow, and a preliminary case study and evaluation performed with pilots from the healthcare, banking, public administration and energy sectors.

A Framework for Privacy and Security Requirements Analysis and Conflict Resolution for Supporting GDPR Compliance Through Privacy-by-Design

“…DEFeND provides a platform to accredit organizations in different regions. This platform aims to have a plan to achieve GDPR compliance and raise awareness regarding its diverse features [22,23]. All the scenarios are taken into consideration by the ConfIS framework which was not resolved by DEFeND project previously.…”

“…Neither one's respective significance can be ignored; however, each scenario accordingly demands individual attention. In our case study-Doctor and Patient, we have used the ConfIS framework on the DEFeND platform that aims to achieve conflict resolutions [23]. For maintaining confidentiality of Patient's record to avoid data breaches, a monitoring system must be installed in the hospitals.…”

Understanding challenges of GDPR implementation in business enterprises: a systematic literature review

“…The general data protection regulation (GDPR) was introduced as a fundamental regulatory framework aiming to harmonise data privacy and personal data protection in the European Union (EU). Nevertheless, since its approval in 2016, the GDPR has posed organisations with numerous challenges in achieving compliance, ensuring data protection and adapting to the evolving data privacy landscape (Piras et al , 2021; Yeung and Bygrave, 2022). This systematic literature review aims to explore and analyse the challenges business organisations face in implementing the GDPR, examining the research gap, and contributing to the existing body of knowledge by identifying directions for future research.…”