Document Type
Article
Abstract
Software should comply with international privacy laws, like the General Data Protection Regulation (GDPR). However, implementing appropriate technical controls is often an error-prone and time-consuming process. This is partly due to the limited knowledge of software engineers about privacy and security. This paper proposes SoCo, a semi-automated approach to support organizations in achieving software compliance with the GDPR data protection principles. To do so, SoCo supports engineers in identifying and integrating appropriate technical controls in sequence diagrams during the design phase. SoCo includes a technique to assist engineers to identify data processing activities in software applications modeled as sequence diagrams that may need to comply with the GDPR, a catalog of privacy and security controls that engineers can use to fix non-compliant activities, and a technique to implement such controls in the non-compliant sequence diagrams. Our evaluation results show that SoCo can help software engineers identify and design appropriate security controls to address GDPR violations and required moderate manual effort when applied to a substantive open-source application.
DOI
10.1016/j.jss.2024.112144
Recommended Citation
Ayala-Rivera, V., Portillo-Dominguez, A. O., & Pasquale, L. (2024). GDPR compliance via software evolution: Weaving security controls in software design. Journal of Systems and Software, 216, Article 112144. https://doi.org/10.1016/j.jss.2024.112144
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 International License.
Publication Details
https://doi.org/10.1016/j.jss.2024.112144