Exploring Automated GDPR-Compliance in Requirements Engineering: A Systematic Mapping Study

Abstract

The General Data Protection Regulation (GDPR), adopted in 2018, profoundly impacts information processing organizations as they must comply with this regulation. In this research, we consider GDPR-compliance as a high-level goal in software development that should be addressed at the outset of software development, meaning during requirements engineering (RE). In this work, we hypothesize that natural language processing (NLP) can offer a viable means to automate this process. We conducted a systematic mapping study to explore the existing literature on the intersection of GDPR, NLP, and RE. As a result, we identified 448 relevant studies, of which the majority (420) were related to NLP and RE. Research on the intersection of GDPR and NLP yielded nine studies, while 20 studies were related to GDPR and RE. Even though only one study was identified on the convergence of GDPR, NLP, and RE, the mapping results indicate opportunities for bridging the gap between these fields. In particular, we identified possibilities for introducing NLP techniques to automate manual RE tasks in the crossing of GDPR and RE, in addition to possibilities of using NLP-based machine learning techniques to achieve GDPR-compliance in RE.

Proposed ethical framework for software requirements engineering

“…Software artefacts developed by software engineers affect the existence and livelihoods of clients and other stakeholders. Software engineers, as professionals, have a duty to consider the values of society [13,37]. Therefore, during the development of a useable and valuable software system, these professionals should give due attention to ethical concerns as part of the system's basic requirements.…”

“…Decades have lapsed since requirements engineering has been discovered to be one of the most significant phases in developing flourishing software products [12]. To develop a successful software system, requirements should be gathered and analysed in a scientific way [13]. So, software engineers should give due attention to the identification, analysis, specification, and validation of requirements.…”

“…From their research, the most widely occurring challenges and problems include security-related problems, a lack of integrated models and frameworks for requirements engineering processes, quality-related problems due to insufficient requirements engineering processes, missing requirements, giving less attention to non-functional requirements, and so on. Aberkane et al [13] carried out systematic and grey literature reviews concerning ethical issues in requirements engineering. Ramingwong [33] reviewed requirements engineering problems.…”

“…Aberkane et al . [13] carried out systematic and grey literature reviews concerning ethical issues in requirements engineering. Ramingwong [33] reviewed requirements engineering problems.…”

“…During requirements engineering, incorporating ethical values of software requirements help to identify toxic [11], deceptive [12], incomplete, and other unnecessary requirements [3]. This, in turn, helps minimise the negative impacts of software artefacts for stakeholders as well as the public, and the success of software development projects can be enhanced [13].…”