Abstract:Context: Complying with privacy regulations has taken on new importance with the introduction of the EU’s General Data Protection Regulation (GDPR) and other privacy regulations. Privacy measures are becoming a paramount requirement demanding software organizations’ attention as recent privacy breaches such as the Capital One data breach affected millions of customers. Software organizations, however, struggle with achieving privacy compliance. In particular, there is a lack of research into the organizational practices and challenges involved in compliance, particularly for small and medium enterprises (SMEs), which represent a sizeable portion of organizations. Many SMEs use a continuous software engineering (CSE) approach, which introduces additional adoption and application challenges. For example, the fast pace of CSE makes it harder for SMEs that are already more resource constrained to prioritize non-functional requirements such as privacy. Objective: This paper aims to fill a gap in the under-researched area of continuous compliance with privacy requirements in practice, by investigating how a continuous practicing SME dealt with GDPR compliance. Method: Using design science, we conducted an in-depth ethnographically informed study over the span of 16 months and iteratively developed two artifacts to help address the organization’s challenges in addressing GDPR compliance. Results: We identified 3 main challenges that our collaborating organization experienced when trying to comply with the GDPR. To help mitigate the challenges, we developed two design science artifacts, which include a list of privacy requirements that operationalized the GDPR principles for automated verification, and an automated testing tool that helps to verify these privacy requirements. We validated these artifacts through close collaboration with our partner organization and applying our artifacts to the partner organization’s system. Conclusions: We conclude with a discussion of opportunities and obstacles in leveraging CSE to achieve continuous compliance with the GDPR. We also highlight the importance of building a shared understanding of privacy non-functional requirements and how risk management plays an important role in an organization’s GDPR compliance.

Using an Enterprise Architecture Model for GDPR Compliance Principles

Model Driven Engineering for Data Protection and Privacy: Application and Experience with GDPR

Towards a GDPR-compliant cloud architecture with data privacy controlled through sticky policies

Design principles for the General Data Protection Regulation (GDPR): A formal concept analysis and its evaluation

GDPR Compliance in the Context of Continuous Integration

Modelling Technique for GDPR-compliance: Toward a Comprehensive Solution

Compliance Generation for Privacy Documents under GDPR: A Roadmap for Implementing Automation and Machine Learning

Towards privacy compliance: A design science study in a small organization

The European Union general data protection regulation: what it is and what it means

Analyzing GDPR Compliance Through the Lens of Privacy Policy

Defining a new perspective: Enterprise Information Governance

Enhancing privacy awareness through a novel BPMN based methodology

Using Artificial Intelligence to Support Compliance with the General Data Protection Regulation

Are we there yet? Understanding the challenges faced in complying with the General Data Protection Regulation (GDPR)

Semantic Modelling of Organizational Knowledge as a Basis for Enterprise Data Governance 4.0 -- Application to a Unified Clinical Data Model

The GDPR and Its Application in IoT and Connected Cars Opportunities for Business and Competitivity

The Future of International Data Transfers: Managing Legal Risk with a User-Held Data Model

Automating the Extraction of Rights and Obligations for Regulatory Compliance

Assessing IT Architecture Evolution using Enriched Enterprise Architecture Models

Studies on Global Modeling Technology in Enterprise System Design and Governance.

Green Enterprise Architecture (GREAN)—Leveraging EA for Environmentally Sustainable Digital Transformation