Abstract:Context: Complying with privacy regulations has taken on new importance with the introduction of the EU’s General Data Protection Regulation (GDPR) and other privacy regulations. Privacy measures are becoming a paramount requirement demanding software organizations’ attention as recent privacy breaches such as the Capital One data breach affected millions of customers. Software organizations, however, struggle with achieving privacy compliance. In particular, there is a lack of research into the organizational practices and challenges involved in compliance, particularly for small and medium enterprises (SMEs), which represent a sizeable portion of organizations. Many SMEs use a continuous software engineering (CSE) approach, which introduces additional adoption and application challenges. For example, the fast pace of CSE makes it harder for SMEs that are already more resource constrained to prioritize non-functional requirements such as privacy. Objective: This paper aims to fill a gap in the under-researched area of continuous compliance with privacy requirements in practice, by investigating how a continuous practicing SME dealt with GDPR compliance. Method: Using design science, we conducted an in-depth ethnographically informed study over the span of 16 months and iteratively developed two artifacts to help address the organization’s challenges in addressing GDPR compliance. Results: We identified 3 main challenges that our collaborating organization experienced when trying to comply with the GDPR. To help mitigate the challenges, we developed two design science artifacts, which include a list of privacy requirements that operationalized the GDPR principles for automated verification, and an automated testing tool that helps to verify these privacy requirements. We validated these artifacts through close collaboration with our partner organization and applying our artifacts to the partner organization’s system. Conclusions: We conclude with a discussion of opportunities and obstacles in leveraging CSE to achieve continuous compliance with the GDPR. We also highlight the importance of building a shared understanding of privacy non-functional requirements and how risk management plays an important role in an organization’s GDPR compliance.

Towards a taxonomy of privacy requirements based on the LGPD and ISO/IEC 29100

Assessing frameworks for eliciting privacy & security requirements from laws and regulations

Social Network Analysis, Ethics and LGPD, considerations in research

The General Data Protection Law in Brazil: What Comes Next?

Towards privacy compliance: A design science study in a small organization

An Exploratory Mixed-Methods Study on General Data Protection Regulation (GDPR) Compliance in Open-Source Software

Experimental Evaluation of a Checklist-Based Inspection Technique to Verify the Compliance of Software Systems with the Brazilian General Data Protection Law

The General Law Principles for Protection the Personal Data and their Importance

A Taxonomy for Mining and Classifying Privacy Requirements in Issue Reports

Privacy at the e-government within user-centered design and human-centered design context: a literature review

Understanding the Implementation of Technical Measures in the Process of Data Privacy Compliance: A Qualitative Study

Exploring the Relationships between Privacy by Design Schemes and Privacy Laws: A Comparative Analysis

GDPR Compliance in the Context of Continuous Integration

GDPR-Relevant Privacy Concerns in Mobile Apps Research: A Systematic Literature Review

Privacy Essentials

Taxonomy of the GDPR-based Privacy Research by Scientometric Analysis

Legal Requirements Analysis

A BERT-based Empirical Study of Privacy Policies' Compliance with GDPR

Law-based and standards-oriented approach for privacy impact assessment in medical devices: a topic for lawyers, engineers and healthcare practitioners in MedTech

General Data Protection Regulation in Health Clinics

Ontologies for Privacy Requirements Engineering: A Systematic Literature Review