Privacy, security, legal and technology acceptance elicited and consolidated requirements for a GDPR compliance platform

Abstract

Purpose General data protection regulation (GDPR) entered into force in May 2018 for enhancing personal data protection. Even though GDPR leads toward many advantages for the data subjects it turned out to be a significant challenge. Organizations need to implement long and complex changes to become GDPR compliant. Data subjects are empowered with new rights, which, however, they need to become aware of. GDPR compliance is a challenging matter for the relevant stakeholders calls for a software platform that can support their needs. The aim of data governance for supporting GDPR (DEFeND) EU project is to deliver such a platform. The purpose of this paper is to describe the process, within the DEFeND EU project, for eliciting and analyzing requirements for such a complex platform. Design/methodology/approach The platform needs to satisfy legal and privacy requirements and provide functionalities that data controllers request for supporting GDPR compliance. Further, it needs to satisfy acceptance requirements, for assuring that its users will embrace and use the platform. In this paper, the authors describe the methodology for eliciting and analyzing requirements for such a complex platform, by analyzing data attained by stakeholders from different sectors. Findings The findings provide the process for the DEFeND platform requirements’ elicitation and an indicative sample of those. The authors also describe the implementation of a secondary process for consolidating the elicited requirements into a consistent set of platform requirements. Practical implications The proposed software engineering methodology and data collection tools (i.e. questionnaires) are expected to have a significant impact for software engineers in academia and industry. Social implications It is reported repeatedly that data controllers face difficulties in complying with the GDPR. The study aims to offer mechanisms and tools that can assist organizations to comply with the GDPR, thus, offering a significant boost toward the European personal data protection objectives. Originality/value This is the first paper, according to the best of the authors’ knowledge, to provide software requirements for a GDPR compliance platform, including multiple perspectives.

DEFeND DSM: A Data Scope Management Service for Model-Based Privacy by Design GDPR Compliance

“…The rest of the paper is organized as follows. Section 2 summarizes the requirements we elicited in previous works [16,17], and answers to RQ1 providing the activities and strategies for PbD we derived for the DSM flow and toolkit. Section 3 addresses RQ2 and describes the DSM flow, toolkit, data models, our case study and preliminary evaluation within DEFeND.…”

“…As indicated above, an important aspect of our work was to identify a set of analysis and implementation activities related to PbD. in doing so, we employed a Human-Centered Design (HCD) approach [8], where questionnaires and interviews were used as the basic tool to capture the main stakeholders' requirements with regards to PbD and also to understand the main characteristics that an automated toolkit should possess to support PbD [16,17]. Our approach consisted of 3 main stages [16,17] describe in the next.…”

“…1. DSM components, modules and DSM Data Models (green rectangles) [12,16,17] in DSM are the Data Assessment Model (DAM) and the Data Privacy Model (DPM). DAM is produced in the Data Assessment Component (DAC), then read in the Data Privacy Analysis Component (DPAC) that in turn produces the DPM model.…”

“…RQ1 is the main RQ that this paper tries to answer while RQ2 is a supportive question. To answer the first question we elicited information from Data Protection Officers (DPOs), experts and end-users [16,17] of organizations from different GDPR relevant sectors (e.g., banking, public administration, healthcare, energy). We analysed the outcome of these activities and derived a set of activities, strategies and factors that are important for the implementation of PbD.…”

Applying Acceptance Requirements to Requirements Modeling Tools via Gamification: A Case Study on Privacy and Security

“…Moreover, new classes of requirements are becoming even more important for the entire cycle of Software Engineering (SE), since they guide the entire process in a strategic way from the very early stages of the analysis of any software system. For instance, this is especially true for privacy and security requirements, where poorly conducted analysis often leads to poor designed software systems, causing unlawful exploitation of personal data with damages to citizens, and heavy GDPR fines for large corporations [10,14,16]. This is often the case because software designers deal with privacy and security in an informal and unsystematic way, even though tool-supported methods are available [4,8,9,16].…”