Evaluating a privacy requirements specification method by using a mixed-method approach: results and lessons learned

Toward a Holistic Privacy Requirements Engineering Process: Insights From a Systematic Literature Review

“…It indicates that the inclination to use tools exists but is underutilized. These computer-aided tools can range from web forms [9], [28]- [30] to modeling tools [29], [31], [32], or even use natural language processing techniques [33]- [35]. The distribution of the use of computer-aided tools is depicted in Figure 5.…”

“…This also opens up the use of natural language processing (NLP) techniques applied in textual requirements representation [16]. Requirements can be synthesized from the questionnaire [30], [46], [47], cocreation tools [45] or other methods of eliciting privacy goals from the previous steps.…”

“…The process begins by analyzing the organization's data processing activities [23]. This involves pinpointing the various data categories and assets in play [8], [30], [38], [49], [53]. To generate a comprehensive list of these activities, one can employ tools such as a guided questionnaire [23], [30], [50] or even conduct focus group discussions [25], [45].…”

“…This involves pinpointing the various data categories and assets in play [8], [30], [38], [49], [53]. To generate a comprehensive list of these activities, one can employ tools such as a guided questionnaire [23], [30], [50] or even conduct focus group discussions [25], [45]. Following this, the collection of assets and data inventory is facilitated through surveys and stakeholder interviews [4], [29], [44].…”

“…Various modeling approaches includes Data Flow Diagrams [13], [35], [38], [51], [53], STS-ml (Socio-Technical Security Modeling Language) [46]- [48], SecBPMN2 [48], Secure Tropos (SecTro) [48], JTrust [48], Misuse Case Diagrams [29], [51], [52], UML diagram [37], [42], BPMN [37], [54], Goal modeling diagrams [55], Problem Frames [5], or TOGAF-based modeling [37]. Textual specifications [32], [36], NLP techniques [16], Questionnaires [30], [46], Co-creation tools [45] Functional requirements list [32], Privacy-related entities [36] Stakeholder goals Asset and Data Inventory Data processing analysis [23], Guided questionnaire [30], [50], Focus group discussions [25], Surveys, Interviews [4], [29] Assets and data inventory list [23], Data processing activities [44] Data audit forms [8], Current database, Data flow diagrams Model-based Approach Data Flow Diagrams [13], [51], STS-ml [46], SecBPMN2, Secure Tropos, JTrust, Misuse Case Diagrams [29], [52], UML, BPMN…”