2025-11-11T16:58:09.760494

Privacy by Design: Aligning GDPR and Software Engineering Specifications with a Requirements Engineering Approach

Kosenkov, Zabardast, Fucci et al.

Context: Consistent requirements and system specifications are essential for the compliance of software systems towards the General Data Protection Regulation (GDPR). Both artefacts need to be grounded in the original text and conjointly assure the achievement of privacy by design (PbD). Objectives: There is little understanding of the perspectives of practitioners on specification objectives and goals to address PbD. Existing approaches do not account for the complex intersection between problem and solution space expressed in GDPR. In this study we explore the demand for conjoint requirements and system specification for PbD and suggest an approach to address this demand. Methods: We reviewed secondary and related primary studies and conducted interviews with practitioners to (1) investigate the state-of-practice and (2) understand the underlying specification objectives and goals (e.g., traceability). We developed and evaluated an approach for requirements and systems specification for PbD, and evaluated it against the specification objectives. Results: The relationship between problem and solution space, as expressed in GDPR, is instrumental in supporting PbD. We demonstrate how our approach, based on the modeling GDPR content with original legal concepts, contributes to specification objectives of capturing legal knowledge, supporting specification transparency, and traceability. Conclusion: GDPR demands need to be addressed throughout different levels of abstraction in the engineering lifecycle to achieve PbD. Legal knowledge specified in the GDPR text should be captured in specifications to address the demands of different stakeholders and ensure compliance. While our results confirm the suitability of our approach to address practical needs, we also revealed specific needs for the future effective operationalization of the approach.

academic

基本信息

论文ID: 2510.21591
标题: Privacy by Design: Aligning GDPR and Software Engineering Specifications with a Requirements Engineering Approach
作者: Oleksandr Kosenkov, Ehsan Zabardast, Davide Fucci, Daniel Mendez, Michael Unterkalmsteiner
分类: cs.SE (Software Engineering)
发表时间: 2025年10月31日 (arXiv v2)
论文链接: https://arxiv.org/abs/2510.21591

核心问题: 现有的GDPR合规方法缺乏对需求工程(RE)和软件设计架构(SDA)阶段之间复杂交互关系的系统性处理，导致隐私设计实施中缺乏一致性和可追溯性。
问题重要性:
- GDPR第25条要求"设计隐私保护"，需要在设计阶段就嵌入隐私控制
- 法规合规性影响整个软件开发生命周期(SDLC)的多个阶段
- GDPR涉及异构的软件方面(软件质量和用户行为)
现有方法局限性:
- 缺乏系统性的需求与系统(R&S)规范方法
- 现有研究主要关注RE或SDA的单一视角
- 法规解释的透明度不足，缺乏法律和工程视角的桥接
研究动机:
- 建立GDPR文本与工程规范之间的可追溯连接
- 支持不同利益相关者的协作需求
- 提供系统性的法律知识捕获方法