Semantic web technologies provide an open and adaptable framework for compliance regarding the General Data Protection Regulation (GDPR). Our previous work in this regard demonstrates the use of SPARQL for querying provenance of consent and personal data lifecycles for compliance. We extend this work through our model for evaluation of GDPR compliance using SHACL to validate the correctness and completeness of information. The model describes the creation of a compliance graph consisting of information required to document and demonstrate compliance linked to speci c articles and obligations within the GDPR using the GDPRtEXT vocabulary.
Provenance is one of the important categories of information regarding
compliance with the General Data Protection Regulation (GDPR) due to
obligations surrounding how consent and personal data are collected, stored, used,
and shared. Semantic web technologies have been proven to provide an open
and extensible framework for representation and querying of information
related to such obligations [
We extend this work through our model for evaluation of GDPR compliance
using SHACL3 to validate the correctness and completeness of information. The
model describes the creation of a compliance graph consisting of information
required to document and demonstrate compliance linked to speci c articles
and obligations within the GDPR using the GDPRtEXT [
Pandit et al.
The SPECIAL consent, transparency and compliance framework [
Our model for GDPR compliance, as depicted in Fig. 1, consists of three parts querying (covered in previous work), validating retrieved information (described in this paper), and generating documentation (planned future work). The provenance information is represented using the GDPRov vocabulary and is linked to concepts within GDPR using the GDPRtEXT vocabulary. The model is further explained with an example use-case in an online article4. The feasibility of validation on individual data instances at large scale is questionable due to complexity of analysis. We currently focus only on the model of the system as an abstract representation of the processes and artefacts and their 4 http://openscience.adaptcentre.ie/projects/CDMM/compliance/model.html Exploring GDPR Compliance Over Provenance Graphs Using SHACL interactions. Compliance is therefore an assessment of the organisation's data practices rather than an investigation of a particular data subject's activities.
The requirements for creating validation shapes is gathered from an analysis of the GDPR legal document, various informative articles published by Data Protection Authorities and commercial organisations, and auditing organisations such as European Privacy Seal (EuroPriSe). These are then used to create a set of questions (similar to those within the GDPR readiness checklist) which retrieve information associated with compliance. The questions are then expressed as SPARQL queries and can be adapted for creating shapes for compliance validation using the SHACL-SPARQL extension.
Validation is performed using SHACL (Shapes Constraint Language), a language for validating RDF graphs against a set of conditions termed as shapes and expressed as RDF graphs themselves. The validation occurs in two distinct stages - rst stage (completeness) ensures presence of required information and is carried out before any compliance queries are executed. Ideally, the completeness of the graph is maintained in a continuous fashion. The second stage (compliance) checks for conformance to speci c obligations to evaluate compliance. The process of validation is captured using PROV-O to record its execution.
Compliance validation takes place on a separate graph, termed compliance graph, which is constructed from queries that retrieve and structure the required information. The information within the compliance graph is linked to relevant obligations within the text of the GDPR using the GDPRtEXT ontology. Compliance validation is then performed using SHACL and the assessment is added to the graph. The purpose of this graph is to represent information relevant to compliance, to keep it separate from the data graph which may change with time, to capture a snapshot of the state of compliance, and to assist in the generation of compliance documentation.
The compliance validation process occurs in two stages. In the rst, shapes are validated and results are linked to speci c obligations and added to compliance graph. The second stage of validation tests outcomes of the rst stage against their linked obligations to allow for reuse of shapes to test di erent obligations, and to generate validation directly linked to GDPR articles based on ful lled obligations. At the end of the compliance validation process, the compliance graph contains information required to answer the compliance queries, their results linked to speci c obligations within GDPR, and an indication of the compliance status for GDPR articles.
Documentation and demonstration of compliance can then be performed as SPARQL queries on the compliance graph, and persisted as a compliance report using the EARL vocabulary. Further investigation of how and why the compliance status was achieved is possible by exploring the validation reports and queries present in the compliance graph. This can be exploited to create a tool for top-down exploration of compliance that can be used to document and demonstrate compliance in an interactive fashion.
Pandit et al.
This paper extends our our previous work [
In terms of future work, we plan to create a proof-of-concept demonstration of using SHACL to test compliance obligations with a focus on interactive documentation as described in this paper. There is also the possibility of using graph reduction and summarising techniques to simplify the validation process by representing legal obligations as patterns and testing them for compliance. Finally, we plan to explore compliance coverage as a measure to compare our work with similar work.
This work is supported by the ADAPT Centre for Digital Content Technology which is funded under the SFI Research Centres Programme (Grant 13/RC/2106) and is co-funded under the European Regional Development Fund.