In the last lustrum, the EU General Data Protection Regulation (GDPR) profoundly impacted data processing organizations as compliance with this Regulation became obligatory. Due to resource poverty, complying with the GDPR can be a challenge for small and mediumsized enterprises. In this research, we consider GDPR-compliance as a high-level goal in software development that should be addressed at the outset of software development, that is, during requirements engineering (RE). Moreover, we argue that natural language processing (NLP) can be utilized to automate this process. Therefore, this Ph.D. research aims to address the challenge organizations face by developing an NLP-based automated approach towards GDPR-compliance in RE. In particular, we aim to develop an approach to assess whether a set of system requirements complies with the GDPR to achieve data protection by design and by default, thus providing organizations with an e cient and e ective solution to ensure GDPR-compliance. This paper presents our research questions and their relevance, the adopted research method, preliminary results, and the current state of our research.
Provisionally agreed upon in 2015, the General Data Protection Regulation
(GDPR) came into e ect in May 2018 to ensure and safeguard data subjects'
rights. The GDPR applies to any personal data processing of European data
subjects|regardless of whether the data processing itself takes place in the
European Union|and ensures that individuals are not deprived of their data
protection rights. Furthermore, the GDPR's transnational application results in
far-reaching implications on the digital market of the world [
To achieve GDPR compliance, organizations should take technical and
organizational measures necessary to ensure data protection by design and by default
to achieve GDPR-compliance [
Complying with the GDPR demands signi cant e orts, which can be
especially troublesome for small and medium-sized enterprises (SMEs) due to lack
of resources to take the necessary technical, and organizational measures [
Therefore, we propose using natural language processing (NLP) techniques|
a popular approach amongst requirements engineers [
The main focus of this Ph.D. research is to prevent organizations from compromising the privacy of data subjects and ensuring data protection by design and by default, by addressing GDPR-compliance at the intersection of RE and NLP. The remainder of this paper is structured as follows. Section 2 presents our research questions. Section 3 describes the adopted research method. The preliminary results are presented in Section 4. Section 5 presents the current stage of our research. Related work is presented in Section 6. Finally, Section 7 concludes this paper and elaborates on our plans for future work. 2
The goal of this Ph.D. research is to achieve NLP-based automated GDPRcompliance in RE. In doing so, we aim to build a bridge between GDPR, NLP, and RE to provide organizations with insights towards GDPR-compliance. Furthermore, we intend to develop a machine learning approach based on NLP to facilitate GDPR-compliance and prevent organizations from compromising EU citizens' privacy, thus ensuring data protection. To achieve this, we adopt an incremental approach which is re ected in our research questions (RQs) and the corresponding sub-research questions (SRQs): RQ1 \What is the current state of research as to NLP-based automated GDPRcompliance in RE? " This RQ aims to map the existing literature on the intersection of GDPR, NLP and RE relevant to achieving automated GDPR-compliance. However, since preliminary research yielded no relevant studies, it was decided to formulate SRQs to search all possible combinations of the three domains (i.e., GDPR, NLP, and RE): SRQ1 \What NLP approaches are useful for RE and for which RE activity? " Literature shows that several NLP approaches are available for the di erent activities in RE. However, no systematic literature mapping exists where these di erent approaches are mapped with the tasks they can be used for while upholding the higher goal of automating GDPR-compliance in RE. SRQ2 \Which NLP approaches are available for achieving GDPR-compliance in organizations? " In addition to mapping the NLP approaches explicitly developed for the RE domain, it is also interesting to explore NLP approaches outside the RE paradigm that focus on achieving GDPR-compliance in organizations. This insight will allow us to investigate the possibility of learning from these approaches and transfer this learning to the RE phase in software development.
SRQ3 \Which state-of-the-art RE solutions are available for achieving GDPR-compliance? " This question endeavors to identify state-of-the-art RE solution types that maintain and possibly facilitate the GDPR. The answer to this question will provide us with a topical mapping of the RE developments in achieving GDPR-compliance.
RQ2 \How to automatically assess organizations' GDPR-compliance based on their privacy policy? " This research question aims to assess organizations' GDPR-compliance through an NLP-based machine learning approach. Organizations use privacy policies to convey the taken GDPR-measures to data subjects. We will particularly focus on SMEs and provide them with an e cient and e ective approach to identify possible GDPR non-compliance.
RQ3 \How do organizations di er in their approach to GDPR-compliance? " Building on the previous RQ, this question aims to identify the in uence of organizational factors such as size and industry on GDPR-compliance. The construed machine learning approach of RQ2 will be used to classify a data set comprising organizations and their respective privacy policies on their GDPR compliance. The resulting classi cation will be combined with organizational meta-data of the corresponding organizations, after which possible relationships between GDPR-compliance and organizational factors will be identi ed through machine learning. The outcome may validate the need for a tailored approach towards GDPR-compliance for organizations, addressed in RQ4. RQ4 \How to automatically identify the GDPR-compliance of a set system requirements? " This question is built on the outcomes of RQ2 and RQ3 and aims to devise an automated approach based on NLP and machine learning, tailored to the outcome of RQ3, that can be used to assess, by using NLP-based machine learning, the GDPR-compliance of a set system requirements at the outset of software development and thus achieving data protection by design and by default.
Summarized, we adopt an incremental approach towards our goal of NLPbased automated GDPR-compliance in RE. First, we intend to explore the literature on the intersection of GDPR, NLP, and RE. Next, we aim to develop an NLP-based machine learning approach to assess the GDPR-compliance of organizations' privacy policies. Furthermore, we aim to identify the organizational factors that in uence this GDPR-compliance. Based on the identi ed factors, we intend to devise an automated approach based on machine learning that focuses on achieving GDPR-compliance by design and by default, by automatically assessing system requirements at the beginning of the software development process on their GDPR-compliance. This approach will enable requirements engineering professionals to identify requirements automatically that may lead to non-compliance, consequently instilling a proactive stance towards GDPR-compliance. The envisaged outcomes and solutions are intended to facilitate GDPR-compliance in organizations by providing the corresponding professionals with the means to achieve this compliance. 3
This research adopts the design science research methodology. Design science
research is a research paradigm that focuses on answering questions related to
human problems by creating new and innovating artifacts [
In this Ph.D. research, the need to nd e cient and e ective solutions to ensure GDPR-compliance in organizations forms the problem space of interest. We intend to address this by developing an NLP-based machine learning approach to assist organizations in meeting GDPR-compliance in RE. However, rst, we aim to validate this need and understand the problem space by developing an artifact that assesses GDPR-compliance of organizations based on the measures adopted as communicated through their privacy policies, followed by identifying the organizational factors that contribute to non-compliance|thus iterating between the relevance cycle and the design cycle while contributing to the knowledge base. Based on the outcome, we intend to develop a machine learning approach|in the design cycle|to achieve GDPR-compliance by design and by default, by automatically assessing system requirements in the RE phase of software development on their GDPR-compliance. Finally, we aim to evaluate the performance of this machine learning approach using expert-labeled data.
This Ph.D. research started with conducting a systematic mapping study [
Regarding SRQ1, 420 studies were identi ed, mentioning 199 di erent NLP approaches useful for RE. The most common NLP approaches were part-ofspeech tagging, pre-processing, and text-classi cation with 165, 117, and 104 occurrences, respectively. SRQ2, aimed to identify studies that discuss NLP approaches used to achieve GDPR-compliance in organizations, yielded nine studies in which text-classi cation and pre-processing were the most frequently occurring NLP approaches with 4 and 2 occurrences, respectively. Furthermore, the retrieved studies related to SRQ2 addressed the GDPR concept of anonymization four times, privacy was addressed twice, consent and lawfulness, fairness and transparency occurred each once. Lastly, regarding SRQ3, 20 studies were identi ed that discussed RE solutions for achieving GDPR-compliance in organizations. The most frequent occurring solutions types were Approach and Method, proposed as a solution by four studies each.
Next to the key ndings that addressed our research questions, we discovered several interesting phenomena. First, the mapping revealed a tendency among researchers from the RE community to concentrate mainly on the RE activities of domain understanding & elicitation and speci cation & documentation. Concurrently, the activities of evaluation & negotiation, and quality assurance receive less attention. This development was true for research related to both SRQ1 and SRQ2. For studies related to SRQ1, this may imply that researchers overlooked the possibility of using NLP for the activities of evaluation & negotiation, and quality assurance. Another possibility is that RE tasks in the latter are less suitable for automating with NLP. Second, it could be foreseen from the line of questioning in our research questions that the resulting studies will gravitate towards design science research. Therefore, it is not unexpected that the vast majority of studies focused on proposing a solution and acted within this research paradigm. However, this is done at the expense of other research types, to the detriment of the diversity of RE as a research domain.
Despite identifying only one study on the intersection of GDPR, NLP, and RE, we have|during the mapping process|identi ed possibilities for bridging these research elds to achieve GDPR-compliance through data protection by design and by default in RE. In particular, we focus on literature related to SRQ2 and SRQ3 because they address the GDPR explicitly. Scrutinizing the solutions proposed by literature related to NLP and GDPR (SRQ2) gives rise to the opportunity of introducing these approaches to classi cation problems in the RE domain, for instance, using NLP-based machine learning solutions that identify GDPR-compliance on requirement documents. Moreover, examining the studies related to SRQ3 presents possibilities of using NLP techniques to assist with manual and potentially repetitive tasks on the junction of GDPR and RE. 5
At this stage, we are working towards an approach to automatically assess organizations' GDPR-compliance based on their privacy policy (RQ2). As mentioned in Section 2, this question aims to assess organizations' GDPR-compliance by developing an NLP-based machine learning approach that can be used to assess privacy policies' GDPR-coverage based on a set of prede ned assessment criteria. The results of such a classi cation may imply that a particular organization fails to comply with the GDPR-measures. Speci cally, we will focus on SMEs|due to the threat of resource poverty|and provide them with an e cient and e ective approach to identify possible GDPR non-compliance. Currently, we are concerned with collecting and labeling data that can be used to train our machine learning model. After this process, we aim to build the classi cation model and evaluate its usefulness. Consequently, we will extend this research to RQ3, which focuses on identifying how organizations di er in their approach to GDPR-compliance. In detail, we aim to use machine learning techniques to identify factors (e.g., organization size) that in uence GDPR non-compliance. 6
As manifested through our mapping study, research related to automating
GDPRcompliance is still in its infancy. Due to the relative novelty of the GDPR (i.e., it
is enforced since 2018), not much research was conducted on the intersection of
GDPR, NLP, and RE. In fact, our mapping study (See Section 4) identi ed only
one study on the convergence of GDPR, NLP, and RE [
In [
However, the studies above are located on the crossing of GDPR and NLP, whereas our research aims to use NLP to automate GDPR-compliance in RE to achieve data protection by design and default, thus combining the elds of GDPR, NLP, and RE. 7
This paper presents our research approach to achieve data protection by design and by default through developing an NLP-based machine learning approach to assess system requirements on their GDPR-compliance. In preparation for developing this approach, we have conducted a systematic mapping study to outline the current research state on the junction of GDPR, NLP, and RE. The mapping study shows potential for our intersectional research. Currently, we are devising a machine learning approach to assess organizations' privacy policies on GDPRcompliance to validate the need for data protection by design and by default as intended by our primary objective. Thereafter, we aim to identify organizational factors that in uence GDPR-compliance. Finally, we plan to develop an NLPbased machine learning approach that focuses on achieving GDPR-compliance by automatically assessing the compliance of system requirements at the beginning of the software development process. In summary, this Ph.D. research contributes to a novel research stream on the intersection of GDPR, NLP, and RE by developing an NLP-based automated approach towards GDPR-compliance in RE and towards ensuring data protection by design and by default.
This Ph.D. research is supervised by Prof. Dr. Geert Poels and Dr. Seppe vanden Broucke.