Towards GDPR Compliant Software Design: A Formal Framework for Analyzing System Models Software systems nowadays store and process large amounts of personal data of individuals, rendering privacy protection a major issue of concern during their development. The EU General Data Protection Regulation addresses this issue with several provisions for protecting the personal data of individuals and makes it compulsory for companies and individuals to comply with the regulation. However, few methodologies have been considered to date to support GDPR compliance during system development. In this paper, we propose a processcalculus framework for formal modeling of software systems during the design phase, and validation of properties relating to the GDPR notion of Consent, the Right to Erasure, the Right to Access, and the Right to Rectification. Moreover, the framework enables the treatment of the notion of purpose through privacy policy satisfaction. Validation is performed with static analysis using type checking. Our work is the first step towards a framework that will implement PrivacybyDesign and GDPR compliance throughout the development cycle of a software system.

An abstract reasoning architecture for privacy policies monitoring Abstract   Privacy is a topic of increasing interest not only for scientific communities, but also for public opinion and for regulatory bodies from all Countries. The problem is that privacy management and enforcement are very dynamic activities and monitoring known fallacies of systems is really difficult, since their number grows up day by day. Moreover, monitoring systems for yet unknown vulnerabilities is, of course, even more difficult. Here we want to present a model and an architecture, based on semantics and reasoning, which is able to detect privacy problems by abstract reasoning on monitored information. The methodology we present here fetches data and evidences from logs and other files, applying model transformation techniques in order to populate semantics repository for enacting reasoning actions. We provide here some experimental results in order to prove the strength of the proposed approach.