# Privacy Framework for the Development of IoT-Based Systems
## 1 Introduction
This methodology consists of eleven stages, the sequence and implementation of which are left to the discretion of the project team. Another important methodology specifically designed for IoTSs is the Three-Phase Methodology (TpM), which is a methodological approach designed for the teaching and development of IoTSs. TpM addresses each phase of the development of an IoTS solution in a vendor- and technology-agnostic manner [15]. It consists of three clearly identified phases: (i) business consideration, which focuses on establishing business goals for the IoTS; (ii) requirements gathering, which is dedicated to gathering operational and technical specifications; and (iii) implementation, which includes software configuration, testing, and the actual deployment of sensors and devices. Moreover, TpM has an extended version called TpM-Pro, which is based on the Situational Method Composition approach [16] and helps to select the artifact according to the characteristics of the project. The TpM-Pro approach outlines the most straightforward method for creating IoTSs and maintaining complete project documentation [17]. In software development, the Software Development Life Cycle (SDLC) is a structured process for building and maintaining software through five stages: planning, analysis, design, implementation, and maintenance [18]. Based on our own analysis, neither the SDLC nor the IoT-specific methodologies mentioned above, which often deviate from the traditional SDLC, have specific guidelines to help developers integrate privacy into the IoTS development process. In addition, they lack a clear methodological approach for identifying privacy requirements for specific IoTS projects or solutions. In addition to the complexities mentioned above, building and developing IoTSs requires a group of software developers with a wealth of expertise. These developers must not only understand the needs of consumers, but also comply with regulatory requirements, such as GDPR. Unfortunately, many developers focus on meeting users' functional requirements without adhering to legal standards, as these regulations are often written from a legal perspective that is difficult for developers to interpret. This lack of understanding or focus contributes to IoTSs suffering from inadequate privacy protection, leaving them vulnerable to attacks that could compromise users' personal information and even endanger lives [19,20]. In this context, and based on the aforementioned issues for building IoTSs with enhanced privacy, this paper proposes a privacy framework as a systematic approach to help developers in their journey to develop more secure and privacy-compliant IoTSs. Our approach will help to integrate the required privacy policies into the IoTS development lifecycles and make it easier for developers to comply with them. Our study builds on the TpM-Pro approach proposed by [PERSON] et al. [17], and extends it with systematic steps for extracting privacy requirements and with a set of updated and improved guidelines to obtain a more privacy-enhanced IoTS solution. The TpM-Pro approach was chosen because it starts with a strong focus on understanding the needs and business context of the project, which is usually critical for eliciting privacy requirements in IoTS projects. Furthermore, TpM-Pro includes a detailed phase to identify technical and operational requirements in an organized way, reducing hardware-software inconsistencies. Another advantage is its ability to help address various IoT-specific issues by facilitating incremental deployment with iterative validation, which can help verify the implementation of privacy concerns in an IoTS. In summary, this study comprehensively explores IoTS privacy concerns and addresses issues highlighted in previous work by other authors. Our main contributions are as follows:  
1. **Classification of existing research**: We categorized articles on IoTS privacy issues into different perspectives, simplifying the topic for readers and providing essential background on its challenges and opportunities.